Slashtags

ABSTRACT

A method of requesting a search query to be displayed in a web browser. The method includes receiving search terms and slash operators and generating results based on the search terms and slash operators.

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent application claims priority from and is related toInternational application no. PCT/US10/39395 filed on Jun. 21, 2010,which claims priority from U.S. provisional application No. 61/218,889filed on Jun. 19, 2009, which is hereby incorporated by reference in itsentirety. This application is additionally related to U.S. applicationSer. No. 13/328,464 filed on Dec. 16, 2011 entitled “Combinators”; U.S.application Ser. No. 13/328,547 filed on Dec. 16, 2011 entitled“Combinators to Build a Search Engine”; U.S. application Ser. No.13/328,600 filed on Dec. 16, 2011 entitled “Dedicating Disks to Readingor Writing”; U.S. application Ser. No. 13/328,648 filed on Dec. 16, 2011entitled “Hierarchical Diff Files”; U.S. application Ser. No. 13/328,682filed on Dec. 16, 2011 entitled “RAM Daemons”; and U.S. application Ser.No. 13/328,750 filed on Dec. 16, 2011 entitled “Trash Daemon”.

TECHNICAL FIELD

This application relates to the field of digital computing or dataprocessing, which includes data structures and database/file access andmanagement for, in particular, propagating, searching and retrievingdata in a distributed database system.

BACKGROUND

Distributed database systems can be used to store and access large-scaledata in networked infrastructures such as large clusters, distributedcomputing systems, Intranet, Internet and other informational retrievalsystems. Distributed database systems include storage and processingdevices that are typically managed and controlled by a central databasemanagement system. The central database management system may be storedin multiple computers located in the same physical location, or may bedispersed over a network of interconnected computers.

A distributed database system controlled by a centralized databasemanagement system is limited for a number of reasons. The fact that acentral master controls management functions leads to temporaryunavailability if the master fails, even if the master isfault-tolerant. Also, problems such as network partitions often causeunavailability in at least part of the cluster. Finally, algorithms usedfor fault-tolerance of the master, such as Paxos, often take asignificant time to recover from failures, during which the system ispartly or fully unavailable. Having a central master can also hurtscalability.

In large-scale distributed systems, system devices frequently fail orlose network connectivity due to anomalies such as network disconnectionand power failures. Ensuring continuous system availability in the faceof these frequent failures is extremely important to providing goodlow-latency behavior.

Another problem in distributed database systems is the difficulty ofsupporting high write rates. Even something as simple as counting thenumber of hits on a website with many webservers is considered adifficult problem today. Logfile analysis is often not done inreal-time, because it is too expensive to do so. Statistics such as thenumber of unique clients to access a website are very expensive togenerate.

There are many problems today in distributed databases as applied inparticular to answering search queries. Search engines provide apowerful tool for locating documents in a large database of documents,such as the documents on the World Wide Web (WWW) or the documentsstored on the computers of an Intranet. The documents are located inresponse to a search query submitted by a user. A search query mayconsist of one or more search terms. What is needed are innovativetechniques for extracting relevant information from databasesefficiently and more intelligently. The ability to query a search enginemore intelligently than just typing in a few search terms would be a bigadvance over today's search engines. The display of the results of aquery could also use improvement.

SUMMARY

This disclosure relates to a method of managing a database system. Themethod comprises at the database system having one or more nodescomprising one or more processors and memory. The memory of the one ormore nodes storing one or more programs to be executed by the one ormore processors, receiving an N number of requests from one or morenodes of the database system, combining the N number of requests beforeinitiating operations to attend to the N number of requests, reducingthe number of operations to attend to the N number of requests, andexecuting the reduced number of operations to attend to the N number ofrequests.

In the method, the database system includes a search engine. The searchengine includes a decentralized swarm system that utilizes one or moreswarm algorithms.

The method further comprises the N number of requests may include Nnumber of add requests to add to a value in a row stored in the databasesystem, the combining the N number of requests before initiatingoperations to attend to the N number of requests includes combining theN number of add requests to the value in the row stored in the databasesystem, and the executing the reduced number of operations includesexecuting the operation of adding to the value in the row stored in thedatabase system for the N number of add requests in less than Ntransactions.

This disclosure also relates to a method of using one or morecombinators in managing a database system. The method comprises at thedatabase system having one or more nodes comprising one or moreprocessors and memory, the memory of the one or more nodes storing oneor more programs to be executed by the one or more processors, whereinthe one or more programs includes a set combinator. Receiving a set ofvalues corresponding to an N number of processes from one or more nodesof the database system, combining the N number of processes beforeinitiating set operations to set the values into a table stored in adatabase storage of the database system, reducing the number of setoperations to set the values of the N number of processes, and executingthe reduced number of set operations.

This disclosure further relates to a method of operating a searchengine. The method comprises at search engine that utilizes a swarmdatabase system, wherein the search engine includes one or moreprocessors and memory, storing one or more programs to be executed bythe one or more processors, and the one or more programs including oneor more combinators. In addition, receiving an N number of servicetasks, combining the N number of service tasks before initiatingoperations to attend to the N number of service tasks, reducing thenumber of operations to attend to the N number of service tasks, andexecuting the reduced number of operations to attend to the N number ofservice tasks.

The method further comprises receiving an N number of service tasksinclude receiving a search query from a search engine user.

The method also comprises service tasks that may include ranking dataitems by a ranking combinator, wherein the ranking combinator ranks aplurality of data items, and maintains the top N number of the pluralityof data items.

In the method, service tasks may include maintaining one or more logfiles by one or more combinators, the one or more log files includingcollecting data on number of webpage hits and generating summaryinformation of webpages.

Further, the method comprises maintaining one or more log files by oneor more combinators include one or more append combinators, wherein theone or more append combinators append lines of text to an existing setof lines of text.

In addition, the method comprises maintaining one or more log files byone or more combinators include one or more comb_add combinators,wherein the one or more comb-add combinators is configured to count anumber of items and combine the count to existing data.

The method also comprises service tasks that may include detecting emailspam using one or more spam combinators, wherein the one or more spamcombinators compute a set of signatures based on email headers andcontent, and check whether the same signatures are present in a largenumber of emails to a large number of people.

The method further comprises utilizing a logcount combinator, whereinthe logcount combinator counts how many of the large number of peoplehave received the same signature, and determines the signature to bespam when a predetermined large count value is met.

In the method, the N number of service tasks may include crawling URLsin a webpage by one or more logcount combinators, wherein the logcountcombinators count unique items of a plurality of categories of items.

Finally, the method comprises the plurality of categories of items thatmay include a subset of a group consisting of levels of geographiclocations, GeoIP addresses, class C IP networks of referring domains,anchortext of incoming links, advertisements, shopping web pages, andfacets.

This disclosure relates to a method of counting items in a databasesystem. The method comprises at the database system having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors, identifying an M number of items, counting uniqueitems of the M number of items, determining a logcount for the uniqueitems of the M number of items, and storing the logcount for the uniqueitems.

The method further comprises determining a logcount. The methodcomprises partitioning each of the unique items of the M number of itemsinto a set of N number of parts, wherein each N part includes a subsetof the unique items of the M number of items and wherein each subset ofunique items is expressed as a bit value. Finding the lowest unset bitin each of the N number of parts for each subset of the M number ofitems, setting the lowest bit in N intermediate values for each subsetof unique items in the set of N parts, averaging the lowest unset bitvalues of the N intermediate values for each set of N parts, andapplying the averaged value as a log value expressed in powers-of-two.

In the method, the N intermediate values are stored in the memory of thedatabase, with the final step of applying the averaged value as a logvalue expressed in powers-of-two performed.

The method also comprises determining a logcount includes determining anapproximate count of a set of unique items to an accuracy equal toapproximately plus or minus 50%.

Further, the method comprises determining a logcount. The method mayinclude partitioning each of the unique items of the M number of itemsinto a set of N number of parts, wherein each N part includes a subsetof the unique items of the M number of items and wherein each subset ofunique items is expressed as a bit value, finding the lowest unset bitin each of the N number of parts for each subset of the m number ofitems. Choosing which bit to set in the N intermediate values using anarbitrary exponential decay factor, averaging the lowest unset bitvalues of the N intermediate values for each set of N parts, andapplying the average value as a log value expressed with an arbitrarybase related to the arbitrary exponential decay factor.

In addition, the method comprises the larger bit values in the Nintermediate values are less likely to be set that smaller bit sets.Each N part in the set of N parts includes 32 bits and the totallogcount storage needed includes 128 bits. The M number of items mayinclude the URLs of incoming links to a website.

In the method, where the M numbers of items may include the recipientsof email with a given signature, used to detect email spam. The Mnumbers of items may include the Class-C IP networks of senders of emailwith a given signature, used to detect email spam from bot nets. The Mnumbers of items may include the geographical locations of web pageswhich link a webpage and the M number of items may include the IPsubnets of the internet servers containing web pages which link awebpage.

This disclosure also relates to a method of using one or morecombinators. The method comprises at a search engine, having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors, wherein the one or more programs includes one ormore combinators. In addition, receiving a search query, conducting asearch in the search engine responsive to the received search querybased on one or more predetermined criteria associated with one or moresearch terms in the search query, wherein each pre-determined criteriais associated with one or more combinators, and combining the one ormore predetermined criteria to generate a search result.

The method further comprises the one or more predetermined criteriaassociated with one or more search terms comprise a subset of the groupconsisting of ranking of websites in an index based on a quality factorof websites matched to the search query, ranking of websites in an indexbased on date, ranking of websites in an index based on most recentwebsites associated with one or more terms of the search query, andranking of websites in an index based on importance.

The method also comprises conducting a search in the search engineresponsive to the received search query includes identifying websites inone or more indices having compressed data.

Further, the method comprises conducting a search in the search engineresponsive to the received search query includes identifying websites inone or more indices having data compressed using a table of schemas.

In addition, the method comprises conducting a search in the searchengine responsive to the received search query includes identifyingwebsites in one or more indices having data compressed using a table ofnumbered values.

In the method, the one or more predetermined criteria may include anindex combinator associated with each criteria, the index combinatorassociated with each criteria being configured to combine a first indexassociated with a first criteria and one or more subsequent indicesassociated with corresponding criteria.

The method further comprises the index combinator associated with eachrespective criteria, that may include a plurality of slice combinatorsconfigured to fetch data from a plurality of locations in the searchengine.

The method also comprises the plurality of locations in the searchengine that may include one or more daemon tools of the search engine.The one or more combinators may include a head of full-size compressedentries plus a tail of entries that are a subset of the bits of afull-size compressed entry. The head data is 32-bytes of compresseddata, and the tail data is a subset of 4 bytes of a head data entry.

This disclosure further relates to a method of increasing the speed ofdisk reading and writing operations in a database system. The methodcomprises at the database system having one or more nodes comprising oneor more processors and memory, the memory of the one or more nodesstoring one or more programs to be executed by the one or moreprocessors. The data in the database is partitioned into one or morebuckets and at least two replicas of each bucket of data are stored indifferent storage devices of the one or more nodes, determining a subsetof storage devices that will be dedicated to writing, while keeping atleast on replica of each bucket dedicated to reading, and dedicating atleast a substantial portion of the remaining storage devices to reading.

The method further comprises generating a map that identifies which ofthe one or more buckets of the one or more nodes are available forreading and which of the one or more buckets of the one or more nodesare available for writing, distributing the map to the one or morenodes, and using this map locally within each node to inform each bucketwhether it should be reading or writing.

The method also comprises generating a replacement map after everypredetermined time period and distributing the replacement map to theone or more nodes.

In the method, the one or more nodes are synchronized by a respectiveclock, and the replacement map is adopted when the respective clocks ofthe one or more nodes reaches an N secondary boundary.

Further, the method comprises designating at least one bucket forwriting that may include determining buckets for writing based on theelapsed time since the last write event on the respective bucket.

In the method, designating at least one bucket for writing comprisesdetermining a loop ranging from which one or more nodes have beenwritten to least recently to which one or more nodes have been writtento most recently, determining which buckets of each of the one or morenodes in the loop need read operations, and if none of the buckets onthe respective one or more nodes need read operations, designating thenote to operate a set of write operations.

Finally in the method, designating at least one bucket for writingcomprises organizing the one or more buckets into a plurality of zonesand rotating write only operations through each of the plurality ofzones, wherein at least one of the plurality of zones containing onereplication of the at least two replications of data is designated readonly operations.

In addition, this disclosure relates to a method of managing a databasesystem. The method comprises at the database system having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors. In addition, communicating at a first node in aplurality of nodes, one or more tasks to a second node in the pluralityof nodes, wherein neither the first node nor the second node is a masternode, and responding to the one or more tasks by the second node.

In the method, the one or more nodes are organized into at least twoclusters. The organization into at least two clusters may includevirtual organization of the one or more nodes. At least two clustersspan different geographic locations and at least two clusters are in thesame geographic location.

In addition, the method comprises communicating that may include a localarea network, that may include a wide area network, and that may includecommunicating wirelessly.

This disclosure relates to a method of managing a database system. Themethod comprises at the database system having one or more nodescomprising one or more processors and memory, the memory of the one ormore nodes storing one or more programs to be executed by the one ormore processors. In addition, communicating between a subset of the oneor more nodes to collectively make decisions for the database system,without direction from a master node, and executing one or more actionsin response to the decisions by the subset of the one or more nodes.

The method further comprises communicating between a subset of one ormore nodes that may include receiving, at each node, write instructionsand responding to read requests as they are received.

The method also comprises communicating between a subset of the one ormore nodes that may include communicating a status report between thesubset of the one or more nodes to report on a subset of the groupconsisting of number of files, types of files, availability forreceiving new files, and repair items.

Further, the method comprises communicating between a subset of the oneor more nodes that may include communicating map information, whereinthe map information identifies the location of rows in respective nodes.The map information is communicated after a node has heard from theother nodes in the subset of nodes the location of buckets residing oneach node.

The method further comprises adding a new node to the subset of nodes,wherein the new node communicates availability for accepting files andtasks from the other nodes in the subset of node. The new nodecommunicates a zero configuration as a broadcast protocol to the othernodes indicating it is new to the subset of nodes, wherein the zeroconfiguration is not a configuration file.

This disclosure also relates to a method of managing a database system.The method comprises at a swarm database system having one or more nodescomprising one or more processors and memory, the memory of the one ormore nodes storing one or more programs to be executed by the one ormore processors, replicating data in two or more different buckets. Thedifferent buckets may include storage components on respective nodes andwherein no two of the same bucket replicas reside on the same node ofthe one or more nodes, and communicating servicing information about thereplica residing on a respective node to other nodes in the one or morenodes.

The method also comprises replicating data that may include writing acopy of the data on a row of a table located on a node of the one ormore nodes.

The method further comprises grouping the one or more nodes into aplurality of physical racks, wherein each physical rack includes asubset of the one or more nodes and wherein a single replica of dataresides in one physical rack.

The method also comprising grouping the one or more nodes into aplurality of logical racks, wherein each logical rack includes a subsetof the one or more nodes and wherein a single replica of data resides inone logical rack.

The method further comprising grouping the plurality of physical racksinto at least two zones, wherein each zone includes a subset of physicalracks and wherein a single replica of data resides in a single zone ofthe at least two zones.

In addition, the method comprises replicating data in at least threedifferent buckets that may include replicating the data in at leastthree different buckets that are in close proximity of each other.

Further, the method comprises detecting an error on a failed node with abucket having a replica of data, communicating service information toavailable nodes with a bucket having a replica of the data other thanthe failed node, and bypassing the failed node.

The method further comprises invoking a repair daemon, wherein therepair daemon diagnoses the problem on the failed node and determines arepair action to repair the failed node. The repair daemon determineswhether to replicate the data on another available node or replace thedata on the failed node.

The method also comprises mapping data to the at least three differentbuckets using a hash function, wherein the hash function generates aplurality of identifiers mapped to a table at each node of the one ormore nodes, and locally maintaining and updating the table by each node.

Further in the method, the identifier includes a subset of identifiersin a group consisting of key-value pairs, row keys, location code, nameof bucket, and consistent hashing slots. The hash function converts akey of arbitrary size to a binary hash output of a fixed size.

In the method, the one or more nodes may include a plurality of buckets,wherein the plurality of buckets is variably sized. The plurality ofbuckets being variably sized may include at least a subset of bucketsthat are nested.

This disclosure further relates to a method of locating a row in adatabase system. The method comprises at a swarm database system havingone or more nodes comprising one or more processors and memory, thememory of the one or more nodes storing one or more programs to beexecuted by the one or more processors. In addition, hashing a row keyof the row, determining a prefix of the hashed row key, identifying alist of buckets containing the row based on the prefix, determiningwhich nodes of the one or more nodes communicated storage of the bucketsidentified in the list of buckets, and determining at least one buckethaving a replica of the row.

In addition, this disclosure relates to a method of processing a requestin a database system. The method comprises at a swarm database systemhaving one or more nodes comprising one or more processors and memory,the memory of the one or more nodes storing one or more programs to beexecuted by the one or more processors and receiving a request from anode in the swarm database system. In addition, hashing a row key todetermine whether one or more buckets are available to service therequest, wherein the one or more bucket represents an allocation ofstorage on a respective node of the one or more nodes. Requesting afirst node in the one or more nodes having one of the one or morebuckets available to service the request, requesting a second nodehaving one of the one or more buckets available to service the requestif the first node either cannot service the request or delays respondingby a predetermined time period to the request of service, and sendingthe request to subsequent nodes having one of the one or more bucketsavailable to service the request until the request is serviced by one ofthe one or more nodes.

In the method, the one or more nodes are grouped in a plurality ofsubset of nodes. The first node, second node and subsequent nodes are inthe same grouping of nodes. Simultaneously requesting the first node,second node and subsequent nodes to service the received request, andthe node to respond first services the request.

This disclosure relates to a method of organizing a data in a databasesystem. The method comprises at a swarm database system having one ormore nodes comprising one or more processors and memory, the memory ofthe one or more nodes storing one or more programs to be executed by theone or more processors. In addition, identifying data to store in one ormore tables on a bucket, wherein the bucket is a allocation of apartitioned storage in a node of the one or more nodes, assigning toeach of the identified data an identifier and a data storagehierarchical level of a plurality of hierarchical levels, and mapping toan index and storing each of the data in accordance with the index andassigned hierarchical level.

In the method, the plurality of hierarchical levels may include a firstlevel indicative of the oldest data in the one or more tables on thebucket, a second level indicative of somewhat newer data in the one ormore tables on the bucket, and a third level indicative of the mostrecent data in the one or more tables on the bucket.

The method also comprises storing each of the data that may includewriting data to a row in a table on the bucket of a node of the one ormore nodes by a writer daemon and recording a write operation of thewriting into a transaction log of the node.

Further in the method, the writer daemon delays the writing operation toa respective bucket to collect additional write operations designated tothe same respective bucket. The computer implemented-method furthercomprising receiving write operations from the writer daemon andcombining write tasks of a bucket for a predetermined time period by abucket daemon. The predetermined time period is determined by the timeperiod for the bucket daemon to collect write operations that meet apredetermined file size.

Further, the method comprises bucket daemon writes the data in thecollected write operations to the third hierarchical level; merges thedata stored as the third hierarchical level to the second hierarchicallevel after a first predetermined time period, and merges the data ofthe second hierarchical level to the first hierarchical level after asecond predetermined time period.

The method further comprises designating a merging limit value to one ormore tables on the bucket, wherein the merging limit value is indicativeof a level of the plurality of hierarchical levels, and limiting themerging of files in accordance with the designated merging limit valueby refraining from merging data files in the next level once the mergelimit value level is met.

The method also comprising storing a bloom filter for row keys for eachhierarchical level and consulting the bloom filter to determine whethera given row key is to be found in a given hierarchical level of storage.

Finally, the method comprises combining write tasks of a bucket furtherincludes metering the combined write tasks to prevent the writing to thestorage device from using substantially all the available read/writecapacity of the storage device.

This disclosure also relates to a method of managing a database system.The method comprises at a swarm database system having one or more nodescomprising one or more processors and memory, the memory of the one ormore nodes storing one or more programs to be executed by the one ormore processors. In addition, communicating a request to read data by afirst node to at least a subset of nodes in the one or more nodes,checking the identifier by each respective node in the at least thesubset of nodes, to determine if the requested read data is stored inthe respective node, and providing the read data to the first node ifthe respective node in the at least a subset of nodes includes the readdata.

The method further comprises checking a cache storage associated witheach respective node in the at least the subset of nodes before checkingother storage allocations of the respective node. Managing one or moreread operations by a reader daemon associated with each respective nodein the at least subset of nodes. The cache storage is one of a groupconsisting of RAM, a server storage, Flash storage on a solid-statedrive and Flash on a peripheral component interconnect express card. Thecache is managed by a cache daemon.

The method also comprises communicating a request to read data that mayinclude a request to get data from a row of hashed keys in a tablestored on a bucket of a respective node in at least the subset of nodes,and checking the identifier by each respective node includes hashing arow key as the identifier to determine which one or more buckets in oneof the nodes of the subset of nodes contains the requested data.

In addition, the method comprises the read data is stored in the subsetof nodes as a plurality of replications of the read data and at leastone of the replications is stored in a cache of one of the subset ofnodes. The subset of nodes communicates with each other to determine thelocation of the read data.

Finally in the method, the read data is stored in a plurality ofhierarchical levels ranging from most recent to oldest stored data, andwherein communicating the request to read data includes indicating ahierarchical level to seek the read data up to the indicatedhierarchical level at each node of the subset of nodes.

This disclosure further relates to a method of managing a databasesystem. The method comprises at a database system having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors, computing a target number of buckets available forservicing requests, wherein a bucket is an allocation of storage on anode of the one or more nodes. Determining whether to reorganize orreallocate buckets and sizes of buckets based on the computed targetnumber of buckets, determining one or more buckets to be unconditionallyreplicated, replicating the one or more buckets to be unconditionallyreplicated to one or more target buckets available for servicingrequests, and determining one or more nodes or storage devices that areoverloaded by having more buckets than the computed target number ofbuckets.

The method further comprises determining one or more buckets that are inexcess, wherein the one or more buckets that are in excess may includeextra replications of data and data that is outdated, and dropping theone or more buckets that are in excess. Dropping the one or more bucketsthat are in excess may include deleting the extra replication of dataand data that is outdated. Each of the one or more nodes may include arepair daemon for computing the target number of buckets for eachrespective node.

Further in the method, the repair daemon is configured to service therespective node of a subset of services in a group consisting ofrepairing damage from failed hosts, repairing damage from failed disks,repair corrupted buckets, moving buckets from nodes with too manybuckets to nodes with too few buckets, and integrating a new node to theswarm database system.

Finally, the method comprises determining one or more buckets to beunconditionally replicated include determining a number of replicationsof data that fall below a predetermined number of replications of data.

In addition, this disclosure relates to a method of managing a databasesystem. The method comprises at a swarm database system having one ormore nodes comprising one or more processors and memory, the memory ofthe one or more nodes storing one or more programs to be executed by theone or more processors. Determining one or more data files to delete,moving the one or more data files to delete to a trash directory,truncating, by a trash daemon, one or more larger data files to deleteto smaller sized file pieces, and deleting the smaller sized file piecesby a local operation system.

This disclosure relates to a method of managing a database system. Themethod comprises at a swarm database system having one or more nodescomprising one or more processors and memory, the memory of the one ormore nodes storing one or more programs to be executed by the one ormore processors, dividing one or more tasks for servicing at least twobuckets of different nodes in the one or more nodes into two or moreshards, and processing the servicing of the at least two buckets on thedifferent nodes in parallel.

The method further comprises the servicing of at least two buckets thatmay include read operations and write operations. The servicing of atleast two buckets includes a read operation that reads through all rowsin a table in hash order.

In addition, the method further comprises generating an answer by eithersetting data in the database system or returning data to a main process.

Finally, the method further comprises using one or more combinators tocompute the dividing one or more tasks into two or more shards andprocessing the servicing of the at least two buckets on the differentnodes in parallel.

This disclosure also relates to a method of using one or morecombinators in managing a database system. The method comprises at thedatabase system having one or more nodes comprising one or moreprocessors and memory, the memory of the one or more nodes storing oneor more programs to be executed by the one or more processors, whereinthe one or more programs includes a ranking combinator. Receiving one ormore ranking criteria, ranking a plurality of items based on the one ormore ranking criteria, wherein the number of the plurality of items islimited by a predetermined N number, and replacing the ranking to updatethe plurality of items based on a predetermined time period.

The method further comprises the ranking the plurality of items that mayinclude utilizing a logcount combinator to count and update unique itemsin the ranking of the plurality of items. Each item in the plurality ofitems is ranked according to a scalar variable name and ranking number.Each item in the plurality of items is further ranked according to anextra data structure used to record additional information about thescalar variable name.

This disclosure further relates to a method of managing a databasesystem. The method comprises at a database system having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors, partitioning a plurality of rows and assigning aunique subset of the plurality of rows to each node in a subset of theone or more nodes, wherein the unique subset of the plurality of rowsincluded unduplicated rows, and locally accessing a subset ofunduplicated data from the unique subset of the plurality of rows,without communication to the other nodes in the subset of the one ormore nodes.

In addition, this disclosure relates to a method of compressing data ina database system. The method comprises at a database system having oneor more nodes comprising one or more processors and memory, the memoryof the one or more nodes storing one or more programs to be executed bythe one or more processors. Generating a first version of a firstcompression table of column names and types, generating a second versionof a second compression table of column names and types, receiving datato compress and analyzing the received data based on the firstcompression table and second compression table, selecting a version ofthe compression table that generates the smallest compressed data sizeoutput, and compressing the data in accordance with the selectedcompression table.

The method further comprises generating a plurality of versions of thecompression table having variations in column name and type. Columnnames may include at least one column name including a number from anumbered short string table configured to further compress short stringsin the data, wherein the numbered short string table includes a group ofshort string data assigned to a unique number value. Column names mayinclude at least one column name utilizing one or more structured columnvalues.

This disclosure relates to a method for requesting a search query to bedisplayed in a web browser. The method comprises receiving one or moresearch terms and a slash operator selected from a plurality of slashoperators, and generating a search result based on the one or moresearch terms and the slash operator.

The method further comprises generating the search result comprisesproviding a search result list that organizes content based on the oneor more search terms that are within the category determined by theslash operator. The plurality of slash operators comprises mainstreamoperators, content operators, facet operators, URL operators, and listoperators.

Finally, the method further comprises utilizing pre-intersect commonfilters when generating the search result.

Finally, this disclosure also relates to a method of managing a databasesystem. The method comprises at a database system having one or morenodes comprising one or more processors and memory, the memory of theone or more nodes storing one or more programs to be executed by the oneor more processors. Receiving one or more service tasks involving one ormore threaded operations, utilizing one or more finite state machines toimplement the threaded operations, wherein the one or more finite statemachines are partitioned into N subtasks, and wherein each of the Nsubtasks are organized by a corresponding set of frames, and executingthe one or more threaded operations according to the one or more finitestate machines expressed as corresponding set of frames.

In the method, the corresponding set of frames further comprise apointer positioned at a point where a block is needed until a result isreturned to proceed to the next subtask.

BRIEF DESCRIPTION OF THE DRAWINGS

For a better understanding of the embodiments described in thisapplication, reference should be made to the Description of Embodimentsbelow, in conjunction with the following drawings in which likereference numerals refer to corresponding parts throughout the figures.

FIG. 1 is a block diagram of a distributed network system in accordancewith some embodiments.

FIG. 2 is a block diagram of a distributed database system havingmultiple clusters in accordance with some embodiments.

FIG. 3A is a block diagram illustrating a master system in a distributeddatabase system.

FIG. 3B is a block diagram of a swarm system in a distributed databasesystem in accordance with some embodiments.

FIG. 4 is a block diagram illustrating the adding of a new node to acluster of nodes in a swarm system in accordance with some embodiments.

FIGS. 5A and 5B are block diagrams illustrating a swarm system of adistributed database in accordance with some other embodiments.

FIG. 5C is a block diagram illustrating racks of nodes in a clusteraccording to some embodiments.

FIGS. 6A-6C are block diagrams of mapping and allocating buckets in aswarm system in accordance with some embodiments.

FIGS. 7A-7C are block diagrams of how data is organized and stored in adistributed database in accordance with some embodiments.

FIG. 8 is a block diagram illustrating the exchange of data in a swarmsystem in accordance with some embodiments.

FIG. 9 is a block diagram for a get operation in a distributed databasesystem in accordance with some embodiments.

FIG. 10 is a flow diagram for processing a get request in a distributeddatabase system in accordance with some embodiments.

FIG. 11 is a flow diagram for processing a request in a distributeddatabase system in accordance with some other embodiments.

FIG. 12 is a flow diagram of a process for repairing and managingbuckets in a distributed database system in accordance with someembodiments.

FIG. 13A is a block diagram illustrating how files are deleted in theswarm system 350, 500 according to some embodiments.

FIG. 13B is a block diagram illustrating a parallel mapjob processaccording to some embodiments.

FIG. 14A is a collection of combinator tools in accordance with someembodiments.

FIG. 14B is a block diagram illustrating an add combinator for a node ina distributed database system in accordance with some embodiments.

FIG. 15 is a block diagram illustrating combinators used for writes tothree bucket replications in a distributed database system in accordancewith some embodiments.

FIG. 16A is a diagram of a data structure illustrating a TopN ranking inaccordance with some embodiments.

FIG. 16B is diagram illustrating a conceptual Logcount structure andprocess in a distributed database system in accordance with someembodiments.

FIG. 16C is a flow diagram of a process for using Logcount to count aset of unique items, according to some embodiments.

FIG. 17A is a block diagram illustrating a data structure for mappingthe location of data in accordance with some embodiments.

FIG. 17B is a block diagram of a localized subset of a map in accordancewith some embodiments.

FIG. 18 is a block diagram of a server in accordance with someembodiments.

FIG. 19 is a collection of daemon tools in the server of FIG. 17 inaccordance with some embodiments.

FIG. 20 is a block diagram of a client computer in accordance with someembodiments.

FIG. 21 is an example of a screen display of a search query box inaccordance with some embodiments.

FIG. 22A is an example of a screen display of a search result inaccordance with some embodiments.

FIGS. 22B-22C are examples of a search result items listed in a searchresult in accordance with some embodiments.

FIG. 23 is an example of a screen display of an RSS page for a searchresult in accordance with some embodiments.

FIGS. 24A-24B are examples of a screen display of a LINKS page for asearch result in accordance with some embodiments.

FIG. 25 is an example of a screen display of a CACHE page for a searchresult in accordance with some embodiments.

FIG. 26 is an example of a screen display of a SOURCE page for a searchresult in accordance with some embodiments.

FIG. 27 is an example of a screen display of an expanded search resultlist in accordance with some embodiments.

FIG. 28 is an example of a screen display of an SEO page for a searchresult in accordance with some embodiments.

FIGS. 29A-29B are examples of a screen display of a search result inaccordance with some other embodiments.

FIGS. 30A-30B are examples of a screen display of a search result inaccordance with some other embodiments.

FIGS. 31 and 32 are examples of screen displays of a visualization toolfor a search database system in accordance with some embodiments.

DETAILED DESCRIPTION

Reference will now be made in detail to embodiments, examples of whichare illustrated in the accompanying drawings. In the following detaileddescription, numerous specific details are set forth in order to providea sufficient understanding of the subject matter presented herein. Butit will be apparent to one of ordinary skill in the art that the subjectmatter may be practiced without these specific details. Moreover, theparticular embodiments described herein are provided by way of exampleand should not be used to limit the scope of the invention to theseparticular embodiments. In other instances, well-known data structures,timing protocols, software operations, procedures, and components havenot been described in detail so as not to unnecessarily obscure aspectsof the embodiments of the invention.

A. Architectural Overview

FIG. 1 is a block diagram of a distributed network system 100 accordingto embodiments. One or more clusters 140A-N having multiple nodes(servers) 142A-N and clients 110 are connected to a communicationnetwork 130.

A client 110 can be any of a number of devices (e.g., a computer, aninternet kiosk, a personal digital assistant, a mobile phone, a gamingdevice, a desktop computer, tablet, or a laptop computer). The client110 may include a client application 132, a client assistant 134, and/orclient memory 136. The client application 132 can be a softwareapplication that permits a user to interact with the client 110 and/ornetwork resources to perform one or more tasks. For example, the clientapplication 132 can be a web browser or other type of application (e.g.,a search engine application) that permits a user to search for, browse,and/or use resources (e.g., web pages and web services) located at thenodes 142 in clusters 140A-N. The resources at nodes 142 are accessibleto the client 110 via the communication network 130. The clientassistant 134 can be a software application that performs one or moretasks related to monitoring or assisting a user's activities withrespect to the client application 132 and/or other applications. Forinstance, the client assistant 134 assists a user at the client 110 withbrowsing for resources (e.g., files) hosted by websites; processesinformation items (e.g., search results) generated by nodes 142; and/ormonitors the user's activities on search results. In some embodiments,the client assistant 134 is part of the client application 132,available as a plug-in or extension to the client application 132(provided, for example, from various online sources), while in otherembodiments the client assistant 134 is a stand-alone program separatefrom the client application 132. In some embodiments the clientassistant 134 is embedded in one or more web pages or other documentsdownloaded from one or more servers, such as nodes 142. Client memory136 can store information such as web pages, search results receivedfrom the nodes 142, system information, and/or information about a user.

In some embodiments, each cluster 140 includes multiple nodes 142 forstoring, organizing and accessing information, for example informationextracted from web pages and the internet. However, information may beany type of data or metadata and includes, but is not limited to,documents, files, tables, logs, media files, digital data, and so on. Insome embodiments, nodes 142 are organized by the clusters 140 theybelong to, however, in other embodiments, the nodes 142 may be organizedand accessed in groups and categories that do not depend on the clusters140 in which they belong. In some embodiments, nodes 142 in each of theclusters 140A-N are categorized or organized into sub-groupings withineach cluster 140. Each cluster 140A-N may be in a single geographiclocation. However, a single cluster 140A may span multiple geographiclocations, or multiple clusters 140A-N may span multiple geographiclocations. Therefore, the concept of clusters and nodes may relate to aphysical organization of nodes 142 and to an abstract or virtualorganization of nodes 142.

In some embodiments, the nodes 142 are self-organized in a decentralizedsystem using swarm algorithm(s). In other embodiments, swarm algorithmsare implemented to organize one or more clusters 140 or nodes 142 in amanner such that the nodes 142 interact locally with one another andwith their environment. The swarm algorithm(s) allows for nodes 142 tocommunicate with each other and cooperate with each other viacommunication link 150 to accomplish various tasks within the databaseenvironment and without dependence on a master node.

The communication network 130 can be any wired or wireless local areanetwork (LAN), metropolitan area network, and/or wide area network(WAN), such as an intranet, an extranet, or the Internet, or it may be acombination of such networks. It is sufficient that the communicationnetwork 130 provide communication capabilities between clusters 140,nodes 142, and between clusters 140 and clients 110. In someembodiments, the communication network 130 uses the HyperText TransportProtocol (HTTP) to transport information using the Transmission ControlProtocol/Internet Protocol (TCP/IP). The HTTP permits client computersto access various documents available via the communication network 130.The various embodiments of the invention, however, are not limited tothe use of any particular protocol. The term “document” as usedthroughout this specification refers to any piece of information orservice that is accessible from clusters 140 and can be, for example, aweb page, a file of certain format, a database record, an image, acomputational object, or other information items.

FIG. 2 is a block diagram of a distributed database system 200 thatincludes multiple clusters 240 in accordance with some embodiments.Similar to clusters 140, each of the clusters 240A-N include a group ofnodes 242A-N. In some embodiments, the clusters 240 are coupled to eachother by a cluster connector 220, which may be wired or wireless. Thecluster connector 220 enables communication capabilities between theclusters 240 in the system 200. The connection established by clusterconnector 220 may be an intranet or an extranet, it may enable the localsystem 200 to be connected to the Internet, intranet or extranet viacommunication network 130, or it may be configured to allow acombination of such networks. The system 200 may include a few clusters240A-B or many clusters 240A-N. Clusters 240 may be in a singlegeographic location or span multiple geographic locations. In otherembodiments, a single cluster 240 in the system 200 may span multiplegeographic locations. As illustrated by FIGS. 1 and 2, the variousembodiments of the invention are not limited to any particular networksystem.

B. Architectural Level Swarm vs. Master

FIG. 3A is a block diagram illustrating a master node 310 in adistributed database system (not shown). Most cluster database systemselect a single node 312 (using a system such as Paxos) to be the“master.” The master node 312 typically maintains all the files in thedatabase including tables, control/status information, mapping, andcurrent file locations. The master node 312 also controls system-wideactivities and manages other nodes 314 a-e to communicate instructions,manage replications, request updates, and other managerial tasks. Aclient (not shown) typically must go through the master node 312 toaccess data stored in the other nodes 314 a-e or to send requests to theother nodes 314 a-e. Database operations in the master system 310 aretime consuming because each instruction to the nodes 314 must go throughthe master node 312. For example, in order to send an instruction for aread (or get) operation, time is spent sending the instruction to theservicing node, e.g., Node 4 314 d, via communication link 320 after themaster node 312 receives the request from a client (not shown). Moretime is spent while Node 4 314 d returns a response to the request viacommunication link 324 to the master node 312 before the request isprovided to the client. Additionally, further delays are caused by nodefailures during which reads or writes to the database must typicallywait until the failures are resolved or resources are reallocated tocompensate for failures. Part of the delay includes the time in whichthe master node 312 determines the location of the failure andcommunicates instructions to the other nodes 314 to compensate for thefailures.

FIG. 3B is a block diagram of a swarm system 350 in a distributeddatabase system (not shown) in accordance with some embodiments. Ingeneral, a swarm algorithm in the swarm system 350 creates anenvironment for many nodes 352 a-e to cooperate with one another withouta master node, such as master node 312. The swarm system 350 is ascalable cluster database in which many of its algorithms are swarmalgorithms. The individual nodes 352 in the swarm system 350 makecollective decisions without using a master node, such as master node312 for coordination. A biological example of a swarm environment is aswarm of insects. Instead of relying on guidance or direction from amaster or some centralized intelligent being, a swarm of insects iscapable of directing each other in manner that optimizes availableresources while exploring their environment. Decisions are madecollectively, and not individually or by a single member of the group. Acolony of ants, for example, uses pheromones to explore theirenvironment and direct each other to resources. Honey bees travel longdistances and in multiple directions simultaneously while foraging forfood. Analogously, nodes 352 in the swarm system 350 can exhibitsophisticated collective behavior despite limited intelligence andlimited coordination of its constituents. The swarm system 350 is highlyfault tolerant and highly available, in part due to the lack of a masternode, whose failure causes outages in other systems.

The swarm database system 350 implements a “relaxed eventualconsistency” approach. This represents some trade-offs from the usualACID model (Atomicity, Consistency, Isolation, and Duality) of databaseconsistency, in order to provide higher performance. For other databaseswith “eventual consistency,” reading data back immediately after writingoften results in a stale answer, or an eventual read of the new dataafter a delay. However, the swarm database system 350 is “relaxed” inthe sense that it will fail to become consistent for a small fraction ofdata in the database. Despite the small fraction of failure, the swarmsystem 350 is a high performing data retrieval and management systemthat also operates autonomous without significant human intervention.The swarm database system 350, with the relaxed eventual consistency, isan appropriate database model for applications such as a search engine.

In some embodiments, each of the nodes 352 a-e is configured withsimilar capacity and functionality such that no single node 352 isdominant over any other node 352. In other embodiments, the nodes 352may be configured to have varying capacities, but nonetheless, each node352 in the swarm 350 has equal functionality. In some embodiments, nodes352 communicate directly with each other via communication links 354,356. Each node 352 is enabled to communicate to any one of the nodes 352in the swarm 350. Each node 352 is capable of receiving writeinstructions and responding to a read request as they are received from,for example, a client (not shown). In some embodiments, the nodes 352send status reports to each other to report on number of files, type offiles, availability for receiving new files, repair items and otherconditions relevant to the collective group via communication links 354,356. Thus, the swarm 350 collectively knows where each of the files arelocated in order to respond to a read request and what the availabilityof each of the nodes 352 is to determine which of the nodes 352 canreceive a write request.

Swarm Operation: Mapping

In some embodiments, map information, identifying the location of allrows in respective nodes 352 is distributed by a series of one-to-oneexchanges of data via communication link 354, 356 with all known nodes352. The map data exchanged includes the buckets resident on each node352. After a node 352 has heard from all of the other nodes, the node352 has a complete map of where to find any row.

Swarm Operation: Add Node

FIG. 4 is a block diagram illustrating the configuration of a new node416 being added to a cluster of nodes 412 in a swarm community 400 inaccordance with some embodiments. In some embodiments, the communicationlink 150, 354, 356 is a standard Ethernet broadcast, which travels overwired Ethernet in the swarm community 400. In other embodiments, thecommunication link 150, 354, 356 may be by any wireless communication,such as wireless LAN, other RF communication, or any of the previouslymentioned communication means. Nodes 412 a-n communicate theirrespective status information by broadcast 420. Broadcast 420 may followany number of communication protocols. For example, the broadcast 420may be a short-range broadcast protocol, which is used to find deviceson a local area network system. The various embodiments of theinvention, however, are not limited to the use of any particularcommunication link or any type of protocol.

When new node 416 is added to the swarm community 400, broadcast 420 isused to locate new node 416. New node 416 announces “Here I am!” bybroadcast 422, indicating that it has joined the swarm community 400.Nodes 412 a-n acknowledges receipt of the announcement by broadcast 420,and new node 416 is ready to accept jobs in the swarm community 400. Thebroadcast mechanism allows all nodes 412 to discover the new node 416 bythe transmission of a single network packet. The broadcast protocol forreceiving new nodes added to the community, such as node 416, does notrequire loading a configuration file listing all nodes to the new node416. Thus, this broadcast protocol, “zero config,” is all that isrequired to configure any new node added to the community 400.Additionally, the zero config protocol does not require updating ordistributing an updated configuration file to all the nodes 412 in thecommunity 400. Thus, the nodes 412, 416 are not subjected to the commonmistakes that occur with configuration files, such as errors in coding,delays in uploading, running and maintaining configuration files, andleaving valid nodes unused.

The collective feature of the swarm community 400, thus allows forgreater scalability since multiple new nodes, such as node 416, may beadded to the community 400 without configuration files and additionalcoding. The swarm community 400 also allows for homogenous installationwhen more nodes are added since machines can be integrated into theswarm community 400 with minimal human involvement (e.g., engineers andtechnicians). The swarm community 400 may also be configured to handlegreater fault tolerance, having replication and repair protocols inplace as will be described in later sections, to handle node failures.Thus, the nodes 412 in the swarm community 400 can operate morecontinuously and reliably despite routine failures.

Swarm Operation: Data Replication

FIGS. 5A and 5B are block diagrams illustrating a swarm system 500 of adistributed database in accordance with some other embodiments. In someembodiments, the swarm system 500 includes a replication protocol toreplicate any information (e.g., information received or generated) toat least three different locations, where each of the locations isreferred to as a “bucket.” Whenever a row of a table is written orupdated, it is written or updated into all the appropriate bucketreplicas. Each table in the system 500 has a goal of how many replicasit should have. Rows written to these tables are sent to all replicas atthe time of writing. This goal can be changed at any time, and a daemonhandles making extra copies of the rows if needed. For example, in swarmsystem 500 a, a first data replication R1 is copied to Node 1 552 a, asecond data replication R2 is copied to Node 3 552 c, and a third datareplication R3 is copied to Node 2 552 b. In some embodiments, thereplication of information occurs automatically when the information isreceived. In other embodiments, the replication of information occurswhen certain parameters or conditions are met. In some embodiments, theswarm system 500 has protocols in place or assigned daemons to check andmaintain replicas R1-R3 so that valid, useable replications ofinformation are available at all times. It will be appreciated that thenodes 552 a-e are capable of communicating directly with each other asshown by communication links 554, 556. Each node 552 is capable ofcommunicating information to any one of the nodes 552 in the swarm 500 aand receiving information from any of the nodes 552. However, forsimplicity, not all possible communication links are shown. For example,although not shown, Node 1 552 a may send and receive information to andfrom Node 5 552 e, and Node 3 552 c may send and receive information toand from Node 4 552 d.

In some embodiments, each of the nodes 552 are partitioned into storagecomponents or “buckets,” and the partitions are mapped by tables thatare stored and maintained by each of the nodes 552. In some embodiments,bucket assignments may refer to partitions of the row space for each ofthe nodes 552. In other embodiments, bucket assignments are conceptualpartitions of physical space for multiple nodes 552. The placement ofbuckets in the swarm system 500 is such that no two of the same bucketreplicas reside on the same node 552. As previously indicated, cluster140, 240 may be a conceptual group of machines generally, but do notalways correspond to a physical grouping of nodes 142, 242, 552 (e.g.,servers or other storage machines). The buckets (which are replicatedthree times) are stored on three different nodes 552 a, 552 b, 552 c.The placement is such that each node has at most one replica of aparticular bucket. This allows for system administration tasks (such asreboots) to be performed on the nodes 552 one at a time withoutimpacting more than two replicas of any information.

FIG. 5C is a block diagram illustrating racks 572-576 of nodes 580-584in a cluster 570 according to some embodiments. In some embodiments, thenodes 580-584 are grouped into groups known as racks 572-576, which maycorrespond to the physical location of the nodes 580-584 into physicalracks, or not (e.g., logical organization of racks, organization ofvirtual nodes, and so on). Replicas of a bucket, such as Bucket B areplaced on nodes 580 a, 582 c, 584 a such that only one replica of theBucket B is within a rack 572-576. This allows system administrationtasks to be performed on the cluster 570 one rack at a time, whileensuring two replicas of any piece of data is available.

In some embodiments, a group of nodes may correspond to more than onephysical rack, termed a “zone.” In other words, a node associated with asingle rack may also be associated with a zone that includes other nodesbelonging to other physical racks. Zones are convenient for groupingnodes such that failures in physical components which serve more thanone physical rack only causes a loss of at most 1 replica from eachbucket. For example, in some situations, a single network switch serves3 racks. In practice, to maximize the amount of system administrationwork that can be done at once, the nodes of a database may be organizedwith a goal replication level of 3 into 4 zones. It will be appreciatedthat a zone may alternatively be a grouping of a plurality of logicalracks.

In some embodiments, the swarm system 500 may replicate information moreor less than three times, and the number of replications of informationmay be determined depending on, but not limited to, system design,capacity, machine-type, or other factors. In other words, there may bemore or less than three replicas of each bucket. The swarm system 500allows nodes 552 to read data, or replicate a bucket to a new node 552irrespective of the network topology. Nodes 552 may read from or copyto/from neighboring nodes 552. In some embodiments, a 4-replica cluster140, 240 instead of a 3-replica cluster 140, 240 is possible, where tworeplicas each are in two different locations.

In some embodiments, topology may be important when, for example,determining where buckets should go and which bucket should be accessedfor a read operation when a single cluster, such as cluster 140, 240, isspread over two geographic regions with a relatively narrow network pipebetween the regions. Reading from a bucket replica close by ispreferred. Additionally, for failure reasons, it is useful to have fourreplicas of each bucket, with two in each geographic region. If there isa single failure, there is still a bucket replica close by to read, anda repair daemon (described in later sections) can always make a new copyfrom a nearby bucket replica.

Swarm Operation: Addressing Failures

The system 500 b of FIG. 5B illustrates the manner in which the swarmsystem 500 b addresses failures according to some embodiments. Ingeneral, the system 500 b is designed to have a certain degree of faulttolerance, allowing for normal failure events to occur, withoutinterrupting reading data from or writing data to the database and suchfailures do not require human intervention. If one replica of a bucketfails, then the same information is made available at one of two otherreplicas of the bucket. Thus, information is stored on disks inreplication for fault-tolerance in the swarm system 500 b. Disk failuresinclude a wide range of errors that may occur, including “read errors”reported by the swarm system 500 b or by an Operating System of theclient (not shown), or the failure of data to pass an error detectiontest such as checksum, a CRC (cyclic redundancy check) or otherprocedures for checking data or blocks of data for errors and correctingany detected errors that is stored in buckets (e.g., written ontodisks). When an error is detected in a bucket, that replica of thebucket which failed the test is dropped and data from another replica ofthe bucket is read or processed. A disk failure may cause a node 562 tostop servicing requests for the buckets on that node 562, and the node562 will stop advertising that it serves these buckets in the map.Consequently, the other nodes 552 continue communications 564, 566 toavailable nodes 552 other than the faulty node 562 until the problems tothe node 562 have been resolved. In some embodiments, a disk failure maycause a repair protocol, such as a repair daemon, to be invoked, as willbe described in later sections, which may eventually decide to replicatethose buckets that have fallen below three valid replicas. For example,the repair daemon diagnoses the problem at node 562 and may cause thesystem 500 b to recopy a replica on another available node 552 d or 552e to replace the unavailable replica R3 on node 562.

In some embodiments, the entire node 562 fails, or a bucket or subset ofthe buckets on the node 562 fails, such as “Replica 3 of Bucket B,” andwill stop sending out updates (e.g., map updates to other nodes 552).Eventually, all nodes 552 will recognize that the buckets served by thefailed node 562 or the failed replica of a bucket “Replica 3 of BucketB” is no longer available at that node 562. This will cause the repairdaemon (not shown) to replicate buckets that have fallen below threevalid replications. In some embodiments, it takes three simultaneousmachine failures before the failed node 562 or the bucket replica onnode 562 “Replica 3 of Bucket B” is deemed unavailable. In otherembodiments, more or less than three simultaneous failures may berequired before the node 562 or the bucket “Replica 3 of Bucket B” isdetermined to be unavailable. In some embodiments, if the bucket replica“Replica 3 of Bucket B” on node 562 is determined to be unavailable, thenodes 552 will have communicated to each other (shown as communication564, 566) such that the unavailable bucket replica on node 562 isbypassed, and the two other bucket replicas (for example, on node 552 aand node 552 c) are accessed instead. As in the previous example, theother nodes 552 will continue communications 554, 556 to other validnodes 552 and stop communications to the failed node 562.

Swarm Operation: Allocating Buckets and Hash Operations

FIGS. 6A-C are block diagrams of mapping and allocating buckets 620 in aswarm system 300, 500 in accordance with some embodiments. In someembodiments, the allocation of a “bucket” in a distributed database suchas swarm systems 300, 500, is mapped by hash functions, which is aprocedure or mathematical function to convert large blocks of data intosmaller, organized information, such as metadata, rows, tables, indices,and so forth. Mapping of rows to buckets may be achieved by using a hashfunction to convert a key of arbitrary size to a binary hash output offixed size. In one example, information or the location of informationstored in a particular bucket is identified by the hash function of arow key from a hash table 610, which points to the particular locationwhere a bucket 620 is located. The hash functions, such as the hashfunctions listed in hash table 610, for all row keys are mapped to atable (not shown) residing at each node of the distributed database,such as system 300, 500, and is locally maintained and updated by eachnode. The row key may include a location code, e.g., location=(hash modn_nodes), or may be slots in a table, such as hash table 610, in ascheme called “consistent hashing”.

In either case, each row key or slot points to buckets 620 a-g. In someembodiments, bit prefixes of the hash key (e.g., 00X to 11X . . . inhash table 610) are used to generate or allocate buckets, which can bevariably sized, and the prefix of the keys is determined by the name ofthe bucket. Thus, the variability of bucket size allows for flexibilityand scalability in allocating storage space of the database. In someembodiments, the hash table 610 is a list of prefixes that uses a bitpattern hash to assign or allocate a row key to a bucket 620 a-n(Buckets B1-Bn). The location of a piece of data in a map in thedistributed database, such as systems 300, 500, is determined by thehash of its row key, as described above. The highest bits of the hash,called the prefix in hash table 610, determine which buckets the dataresides in.

In some embodiments, the buckets 620 a-n are nested. For example, onebucket B1 620 a may contain all rows. The prefix for bucket B1 620 a isX, where X can be 0 or 1. Buckets B2 620 b and B3 620 c nest insidebucket B1 620 a. The hash key may be configured such that a row is inbucket B2 620 b if its hash begins with 0, and a row is in bucket B3 620c if its hash begins with 1, as shown in FIG. 6B. Additional buckets B4620 d and B5 620 e, as shown in FIG. 6C, may be nested in bucket B2 620b of FIG. 6B. A row may be in bucket B4 620 d if its hash begins with00, and a row may be in bucket B5 620 e if its hash begins with 01.Therefore, a hash configuration according to hash table 610 indicates arow key whose hash begins with 01 is in buckets B5 620 e, B2 620 b, andB1 620 a.

According to this hash configuration, as shown in FIG. 6B, bucket B2 620b is half the size of bucket B1 620 a. As shown in FIG. 6C, bucket B4620 d is half the size of bucket B2 620 b, and bucket allocation isidentified by double digit prefixes 00, 01, 10, 11. That is, bucket B2620 b contains half of the hash range that bucket B1 620 a does, andbucket B4 620 d contains half of the hash range that bucket B2 620 bcontains. If the hash function successfully distributes row keys evenlyinto hash space, then bucket B2 620 b will be roughly half the physicalsize of bucket B1 620 a.

If it is desired that the buckets in the database be roughly the samesize, the buckets would be accordingly selected to have a range ofbuckets such as buckets B2-B3 620 b-c in FIG. 6B or buckets B4-B7 620d-g in FIG. 6C, and no others. In such a system, a row would exist inexactly one bucket.

Defining the mapping according to hash keys has several benefits. First,the name of the bucket, a small integer, determines the range of keyhashes stored in the bucket. This is more convenient to debug and managethan recording an arbitrary range of hash values being in a bucket.Second, this method allows buckets of different sizes to exist at thesame time in the system. Given a row key hash, it may turn out that themap indicating a particular row might live in more than one bucket,which is convenient when considering multiple replicas of buckets existin the database system. Reading/writing the row would then read from orwrite to all of these buckets. Allowing different-sized buckets allowsvarious flexible and scalable actions, such as splitting or combiningbuckets while the database is running.

Given that a single hash function is used for all mapping of rows tobuckets, a given row will be in the same bucket(s) for all tables whichcontain this row. This is a useful efficiency technique when executingparallel mapjobs. A program accessing all of the rows of a table in abucket on a node is guaranteed that accessing a row in a different tablebut the same row key will be a local access.

In summary, the full sequence of locating a particular bucket and nodethat a row is on is as follows. First, hash the row key. Then use theprefix of this hash and the list of buckets which exist in the system todetermine which bucket(s) contain the row. Finally, look to see whichnodes have announced that they store these bucket(s).

C. Component Level Data Writes

FIGS. 7A-7C are block diagrams showing how data is organized and storedin the swarm database system 100-300 in accordance with someembodiments. Buckets contain multiple tables for storing and managingdata. This data needs to be stored in a manner such that it is cheap toboth read and write data onto rows in multiple tables. Also, the tablesstored in each respective bucket are configured such that altering onetable does not change anything about another table. This separationadditionally reduces the impact of a bug or a storage error.

The data is stored on underlying storage, examples of which include, butare not limited to, a hard disk, flash disk, or ram disk. One embodimentinvolves storing the data in files in a Linux filesystem. Each tablewithin a bucket consists of a hierarchical set of files 734. Oneembodiment uses three levels, named “big”, “mid”, and “inc.” Each file734 has an index mapping the row key hash to a location within the diskfile. This index is loaded into RAM, and ensures that fetching a rowinvolves a single disk seek and read. The “big” file contains the oldestdata in the table, the “mid” file somewhat newer data, and the “inc”files contain the most recent data.

When an application wishes to write to a row in a table, the writeoperation is sent to a “writer daemon” (not shown) on either the localnode or a remote node. The writer daemon writes this data into atransaction log (not shown), which will be replayed for fault-toleranceafter a crash of the local node or of a remote node, or a failure tocommunicate with the remote nodes. In some embodiments, a given rowwrite needs to be delivered to one or more (typically 3) replicas of abucket, which usually reside on three different nodes as previouslydescribed. In some embodiments, the writer daemon will delay a givenwrite for a while hoping to find more writes that need delivering to thesame remote buckets.

In some embodiments, a “bucket daemon” (not shown) receives writes fromthe writer daemons. The bucket daemon remembers and combines write tasksuntil after some period of time has passed or some amount of data hasarrived (e.g., N seconds or M megabytes of data arrive for a particulartable at respective nodes 142, 352). This data is then written to Incfiles on disk. Inc files are eventually combined (merged) into a Midfile, and multiple Mid files are combined into Big file. In someembodiments, another daemon, a bucket_maintenance daemon, does thecombining.

The Operating System is involved in the activity of reading and writingto disk. In many Operating Systems, such as Unix or Linux, data beingwritten to disk becomes “dirty pages” (e.g., the memory page has datathat needs to be written but has not been written yet). A localoperating system (not shown) generally schedules writes of the dirtypage every N seconds or if the number of dirty pages is too large, apercentage of main memory (not shown). Consequently, large chunks ofdata are written at a time, which is generally preferred because largewrites are more efficient than many small writes. However, large writesare a problem for other processes trying to do small reads. Therefore,in some embodiments, write operations are “metered” to break down largewrite operations. In other words, system writes are inhibited bymetering, so that disk capacity is left over to quickly answer reads.For example, a disk that can write 50 MB/s of data can be reduced tometer a write at 8 MB/s. Thus, metering involves splitting a task intosmaller chunks, which are then executed no more than N per second. Inanther example, 100 megabytes of data may be written at 8 megabytes persecond by dividing the 100 megabytes into 25 4-megabyte chunks, andwriting two 4-megabyte chunks to disk per second.

Additionally, operating system features may be relied on such as fsync() function, which allows the system 300, 500 to force writes to go outimmediately instead of after N seconds. The function fsync( ) iscommonly used to minimize data loss in case of a crash. For example, theUnix/Linux/POSIX fsync( ) function forces writes to be immediatelywritten to disk, instead of being kept in a memory buffer so that datadoes not run the risk of being lost. As a result, the write operation ismore efficiently executed.

Using a “Writemap” to Increase the Speed of Reads and Writes

The database described here stores multiple replicas of each bucket aspreviously described. Another way to speed up disk reading and writingis to dedicate a given replica of each bucket to either writing orreading at a given moment in time. Disks run faster if during a shorttime period (less than 1 second) a physical disk or storage system doesonly reads or only writes rather than executing a mix of reads andwrites in a given physical disk or storage system. For example, a‘writemap’ may be created which contains information for each bucket ofwhich replicas are available for reading and which are available forwriting. A physical disk or storage system containing multiple replicasneeds to have all bucket replicas either reading or writing to get thebenefit.

A new writemap is generated every N seconds, for example N=30 seconds.This somewhat long time period allows plenty of time to distribute thewritemap to all of the nodes of the cluster. The nodes have their clockssynchronized to within a few milliseconds, and the new writemap isadopted when everyone's clock reaches an N second boundary. It isimportant that all nodes agree which disks are dedicated to reading orto writing because all readers must know which nodes to send get andnextrow operations.

A given replica of a given bucket must be allowed to eventually write orthe write data from the bucket daemon will pile up in memory(starvation). Thus, every bucket replica may be given a chance to writeat least ⅓ of the time in an R=3 system. In fact, the algorithm used topick the replicas for writing considers the elapsed time since the lastwrite as the primary factor for picking which replicas are writeable.

With this algorithm, at least one replica of a given bucket must beavailable for reading, and the read algorithm must attempt to read from‘read replicas’ before cut-n-running to the ‘write replicas’.

An example of an algorithm for picking which disks to write to include:

-   -   Loop over the storage devices from the ones that have been        written to least recently to the ones written to very recently.    -   For each bucket replica on this storage device, see if any of        these buckets are needed to be the 1 read replica for this        bucket.    -   If no bucket replicas need to be readers, then set this storage        device to be a writer.

Another method of picking which disks to write to is to use theorganization of the database into zones. Simply rotate through thezones, picking 1 zone per N seconds to write to. Since an r3 clusterusually has 3 or more zones, this method often provides less writebandwidth than the previously-described method.

Data Organization

FIG. 7A illustrates how data is written to a respective node in adistributed database, such as swarm system 300, 500. As previouslydescribed, the bucket daemon receives writes from the writer daemons.The bucket daemon holds on to writes 712 for a while hoping to receivemore writes for the same table, but eventually writes out all the writes712 it has for each table as a new Inc file 718. These Inc filesproliferate, as illustrated by Inc files 716 . . . 718, and eventuallythe bucket maintenance daemon notices and decides to merge together abunch of Inc files 716 . . . 718 into a single Mid file 720. The Incfiles 716 . . . 718 are then removed. In some embodiments, multiple Midfiles then proliferate, in other embodiments there is at most one Midfile 720, and when Inc files are merged they are combined with theexisting Mid file 720 if present to form a new Mid file. Eventually, thebucket maintenance daemon will combine the Mid file 720 with a Big file722 to form a new Big file 728. In some embodiments, the Big file 728 isthe result of merging multiple Big files like Big file 722.

Different tables in the same bucket, such as Bucket 2 730, each havetheir own sets of files. In FIG. 7B we see three tables 732, 736, 740.Table Foo 732 and Table Bar 738 have been written to recently, and thushave files at all 3 levels of the hierarchy 734, 738. Table Nap 740hasn't been written to in a long time, and the bucket maintenance daemonhas merged all of the data in this table into a single Big file 742.

When data is read out of these files 732, 736, 740, the cost andaccuracy of the answer depends on how many files are present. To get aperfect answer to a read request for a row, every file for the table islooked at. For Table Nap 740 this is exactly one file, so there is 1disk seek. For Table Foo 732, many disk seeks may have to occur to besure that the right answer is located. For example, the row associatedwith the data being sought might exist in the Big file, but the rowmight have been modified in the Mid or Inc files. So all files need tobe consulted to get an accurate answer. If assuming, each disk seektakes 2 ms (milliseconds) to 10 ms, a table with 200 files might takequite a while to answer a read request.

The distributed database, such as system 300, 500, allows for a tradeoff of accuracy for speed. FIG. 7C illustrates this. The name of thevalue used to limit accuracy is “seekdepth”. It is the maximum number ofdisk seeks to be done. In Table Foo 1 752 a read of a row is conductedwith a seekdepth=1. In this case, only the Big file is consulted 758,and the data in the Mid and Inc files are ignored. In Table Foo 2 760, arow read is set to a seekdepth=3. In this case, at most three files areconsulted 764. Thus, the read of Table Foo 1 752 will be faster but lessaccurate than the read of Table Foo 2 760. Seekdepth may be set with adefault on a per-table basis, or in an individual read request.

Merging Incs into Mids and Mids into Bigs reduces the number of files ina table. This number of files is also referred to as the seekdepth. Todetermine how much merging work needs to be done to leave all of thedata in Big files, the worst seekdepth in the system is computed, andthis value is named seek100. The count of seekdepth in all replicas ofall buckets in the system is also determined, and the seekdepth value iscomputed at the 50th and 90th percentiles. These numbers are calledseek50 and seek90 respectively. These values may be graphed as afunction of time to visualize the interaction of writing and mergingdata (e.g., how much writing is occurring and how much merging isnecessary).

In some embodiments, a bloom filter is kept in memory, and may be usedto avoid consulting a file on disk if the Bloom filter indicates that aparticular row key is not present in that file. This is especiallyhelpful in paths with a large seekdepth.

Component Data Read/Write Overview

FIG. 8 is a block diagram illustrating the exchange of data 802 beingwritten to 804 or read from 806 nodes 812 in a cluster 810 according tosome embodiments. The cluster 810 includes nodes 812A-812G. As in FIG.3B, the nodes 812A-812G communicate directly with each other, and eachnode 812 may communicate to any one of the nodes 812A-812G in thecluster 810. The nodes 812 in cluster 810 broadcasts their statusupdates and other information via communication devices 820. Aspreviously described, communication devices 820 may be enabled by wiresor may be for wireless communication. In some embodiments, not all thenodes 812 respond to data 802 being received, or alternatively torespond to a get data request. For example, some of the nodes, e.g.,nodes 812B, 812C, 812E, 812F respond as data 802 is received 804 becausethese nodes may have available buckets for storing the received data. Ifa data request is received, one of the responding nodes may broadcast toother nodes 812 that it has the requested information. In someembodiments, the broadcasting nodes 812B, 812C, 812E, 812F may be sendor updating status reports and updating their own tables, information,broadcasting a repair request or any other managerial tasks. In someembodiments, one or more of the broadcasting nodes 812B, 812C, 812E,812F may be a new node and broadcasting to other nodes 812 to assistwith tasks or receive data to store.

Once a node 812 is part of the cluster 810, a number of managerial toolsand protocols are shared or implemented in all the nodes 812 in thecluster 810. For example, a repair daemon (not shown) on the node 812will begin operating. If the node 812 is a new one and has no buckets,it will begin volunteering to replicate buckets resident on overloadednodes 812, until the new node reaches its bucket goal. Each of the nodes812 include a number of programs or daemons to perform a number of tasksrelated to the database system. These programs include, but are notlimited to webservers, crawlers, image crawlers, trash daemon, globaldaemon, logger daemon, fileserver daemon, mapjob daemon, repair daemon,ram daemon, bucket daemon, bucket_maintenance daemon, reader daemon,writer daemon, heartbeat daemon, monitoring daemons: out-of-memory (oom)daemon, and check-r daemon. Some of the daemons will be discussed infurther detail.

Reading (Get Data): Generally and Cache

FIG. 9 is a block diagram illustrating the collaboration between twonodes 910, 940 for a get request task in a distributed database systemin accordance with some embodiments. A request to get data 912 isreceived at Node 1 910. The get data request 912 corresponds to arequest to get a row from the database such as cluster 810. When therequest is made, the row key is first hashed to determine which bucketsthe row appears in. The get data request 912 is received by a readerdaemon 914 in Node 1 910, which executes get( ) requests. In someembodiments, the reader daemon 914 hashes the row key.

In addition to information stored on disk, which is stored replicatedfor fault-tolerance, some information for faster access is in a cache,such as cache 916. In some embodiments, the cache 916 is managed by thereader daemon 914, but in other embodiments the cache 916 may be locatedexternal to a local disk in Node 1 910 or external to Node 1 910 and maybe managed by other daemons. In some embodiments, the cache 916 may beeither in RAM, on a server, in Flash on a solid-state drive (SSD), orFlash on a Peripheral Component Interconnect (PCI) Express card. In someembodiments, the data stored in RAM/Flash may not be a replica, butinstead a copy of data that is stored, replicated, on disk. In someembodiments, the reader daemon 914 is used to read data from cache 916.The reader daemon 914 first checks the cache 916 to determine whetherthe requested data 912 is already stored in the cache 916. In someembodiments, the reader daemon 914 may include a RAM cache (not shown)in addition to cache 916, or the node 910 may include a RAM cachedaemon, configured to store data from buckets for responding to queriesfaster. In some embodiments, the first replica is stored in the RAMcache or the cache 916, if the first replica is always requested firstbefore searching the location of second or third replications ofinformation. In some embodiments, the first replica of data is lockedinto the RAM cache or the cache 916 so that it can be provided veryquickly in response to queries. In some embodiments, the RAM cache orthe cache 916 is transparent to the programmer, such that if a responseto a query cannot be provided quickly, because that part of the bucketin the node 910 has not been uploaded yet, it will read the answer offof the RAM cache or the cache 916.

If the answer to the get data request 912 is not in the RAM cache or thecache 916, reader daemon 914 may make the request via communication 924to another node 940, Node 2, known to contain the bucket correspondingto the hashed row key. If that node 940 does not reply quickly, a secondrequest is made to the third node (not shown) with that bucket, and soon.

In some embodiments, a bucket daemon 942 in the next node 940, Node 2,receives the get request from reader daemon 914. Bucket daemons, such asbucket daemon 942, manages one or more buckets in respective nodes tocomplete tasks that include processing requests, retrieving informationfrom buckets stored on disk 944, or writing information to disk 944.Bucket daemon 942, checks 948 the local disk 944 for the requested rowaccording to the row key hash. If the disk 944 contains the requestedrow, the information is returned to the bucket daemon 946 for delivery.In some embodiments, the retrieved information is returned to the readerdaemon 914 via communication 922 for final delivery to the requestor. Insome embodiments, the bucket daemon 942 delivers the retrievedinformation directly to the requestor.

In some embodiments, after the row key is hashed, the get data request912 is simultaneously sent to two or more nodes 910, 940. As the getdata request 912 is being processed in Node 1 910, the request is alsosent via communication 920 to Node 2 940. In some embodiments, the getdata request 912 may be processed similarly, following a common protocolfor all nodes 910, 940. For example, the get data request 912 may befirst received by local reader daemons to check the local cache or ramcache. If the local cache or ram cache does not contain the row, thelocal bucket daemon may process the request 912. In some embodiments,the get data 912 may be processed independently, for example the readerdaemon 914 may first check the cache 916 in Node 1 910, while the getdata request 912 in Node 2 940 is first received and processed by thebucket daemon 942. Thus, nodes in cluster 810 may follow a commonprotocol for processing and managing information; the nodes may locallyprocess and manage information independent of one another; or the nodesmay follow a protocol that is a combination of both.

Reading (Get Data): Cut & Run

FIG. 10 is a flow diagram for processing a request in accordance withsome embodiments. A request may be received by the system 810 from anynumber of sources, including but not limited to, a client such as client110, another node 812 from cluster 810, another node 142, 242 fromanother cluster 140, 240, and so on. The request may be, but is notlimited to, a read request, a get request, a nextrow request, a requestto make status updates, request to update local tables and maps, or anytype of a remote procedure call (RPC) within the cluster 810 or from asource external to cluster 810. Upon receiving a request, at step 1010,a row key is hashed at step 1020 to determine whether a bucket is ableto service the request. Once one or more buckets are determined, a firstnode having one of the buckets is asked to service the request at step1030. If the first node responds quickly, at node 1040, and there is nodelay, the reply to the request is received from the first node at step1050, the first node processes the request, and the process is stopped.In some embodiments, if the first node does not respond or is delayed inresponding, a second node having one of the determined buckets is askedto service the request at step 1060. Again, if there is no delay inresponding by the second node at step 1070, the reply to the request isreceived by the second node at step 1050, the request is processed bythe second node, and the process ends. In some embodiments, if thesecond node delays in responding at step 1070, a third node having oneof the determined buckets is asked to service the request at step 1080.The process is repeated, where if there is no delay at step 1090 inresponding by the third node, the reply to the request is received atstep 1050, the request is serviced and the process ends. If there is yetanother delay at step 1090, the request process is repeated, and thefirst node is again requested at step 1030. In some embodiments,particularly if more than three replications of data are maintained bymore than three buckets, the process continues until the request isserviced by an available node 812 in cluster 810 or by another node 142,242 in another cluster 140, 240.

FIG. 11 is a flow diagram for processing a request in accordance withsome other embodiments. Similar to steps 1010 and 1020 of FIG. 11, uponreceiving a request at step 1110 (e.g., an RPC) a row key is hashed atstep 1120 to determine whether a bucket is able to service the request.Once one or more buckets are determined, all the nodes with buckets areasked to service the request at step 1130. The first available node thatreplies services the request. When the first available node replies tothe request at step 1140, the process is stopped. In some embodiments,the nodes are from the same cluster 810 or from different clusters 140,240.

Nextrow( )

In some embodiments, a second kind of read operation, nextrow( ) is usedto read through all the rows in a table in hash order. This is typicallyused in Mapjob tasks that are computing something for every row in atable. Nextrow( ) for example in a Mapjob (described in later sections),is silently transformed from a call that goes over the network to onewhich reads from local disk, which is a much more efficient process. Insome embodiments, the same code as a Mapjob and as a non-Mapjob may beused for Nextrow( ) operations, which makes testing and debugging easy.The Mapjob version, however, runs much faster over large amounts ofdata.

In some embodiments, an index of some key(s) (not the hashed key) and/orsome columns in a table are maintained in memory. This index is usedwhen nextrowing( ) to efficiently access a range of keys or columnvalues.

Repair

FIG. 12 is a flow diagram of a process for self-repairing and managingbuckets in a distributed database system in accordance with someembodiments. Each node 812 of the cluster 810 includes a repair daemonthat is invoked starting from when a node is added to the cluster 810.The repair daemon uses swarm algorithms to coordinate without using amaster node. The repair daemon is part of the fault toleranceinfrastructure, and repairs the damage from failed hosts, failed disks,and corrupted buckets. The repair daemon also helps load balancing bymoving buckets from nodes with too many buckets to nodes with too few.For example, a new node beginning with no buckets will be given some bythe repair daemon.

The repair daemon computes a target number of buckets for each node, atstep 1210, using information such as the number of disks, CPU (centralprocessing unit) power, disk usage, and so on for each node 812. Thesetargets are computed by every node for every node usingglobally-available information. If a node fails, for example, the buckettargets for the remaining nodes will all rise slightly. If a new node isadded, it will receive an appropriate target, and the targets for allthe other nodes will decrease slightly. In some embodiments, every node812 uses the same data to compute these targets, and thus most nodes 812will calculate the same target goals most of the time. The target numberis then used to determine whether to reorganize or reallocate bucketsand bucket sizes. At step 1215, the repair daemon looks for buckets thatshould unconditionally be replicated. Buckets are unconditionallyreplicated if, for example, buckets were duplicated within the same rackor buckets that have less than three replicas. For example, fewer thanthree replicas of a bucket initiate a node request to make a replica ofthe bucket. In some embodiments, the count does not include buckets ornodes that have been marked “HOSTABANDON” or “HOSTBAD.” Buckets markedHOSTABANDON and HOSTBAD are administrative conditions set by a human tostop the use of hosts as soon as their buckets can be removed, while theremoval without causing any alerts that the number of these “bad”buckets are less than three replicas. The repair daemon identifiesbuckets that need to be replicated, and at 1220 a node with an availablebucket space is chosen. In some embodiments, the available bucket spaceis selected at a location where another replica of the bucket is notlocated so that no two buckets reside on the same node 812. The bucketis replicated at step 1230 from the node identified with the bucket tocopy to ensure that three valid replicas of the bucket is stored.

In some embodiments, if there are no unconditional replicas to make,then at step 1235, the repair daemon considers replicating buckets fromnodes that appear to be overloaded. Overloaded nodes are chosen based oncomparing the target number of buckets with the actual number of bucketscurrently on the host. Nodes 812 with more actual buckets than thetarget are overloaded; nodes 812 with fewer actual buckets than thetarget are underloaded. If overloaded nodes are identified at step 1235,an overloaded node is selected at step 1240. At step 1250, a bucketresiding on the overloaded node is selected to replicate. One or morebuckets may be selected from the overloaded node. Since there aretypically multiple replicas of every bucket available to be copied, therepair daemon picks which node to copy from based on factors such as howmany copies that node is currently engaging in, or how far behind onwrites the bucket is, and so on. A copy of the one or more bucketsresiding on the overloaded node is replicated from some node containingreplicas of the selected buckets at step 1260. In some embodiments,unloading overloaded nodes is repeated until all the overloaded nodesare serviced.

In some embodiments, the repair daemon, at step 1265 also considersdropping buckets when there are four or more replicas of the samebucket. In some embodiments, if there are no excess buckets, the repairdaemon is done at step 1270. In some embodiments, the repair daemon inevery node does the same computation to identify excess buckets usingthe same input data, such that all the nodes with the bucket will knowwhich node is the best one to drop the excess bucket. In determiningwhich node should drop the excess bucket, at step 1280, the repairdaemon considers, for example, whether the bucket or updates to thebucket are behind on a particular node, whether the bucket is duplicatedwithin the same rack, or that node is overloaded. Once the node isidentified, the excess bucket is dropped at step 1290. In someembodiments, the process of dropping excess buckets is repeated if morethan one node has excess buckets.

Delete

FIG. 13A is a block diagram illustrating how the swarm system 1300deletes files according to some embodiments. In some embodiments, thenodes, such as 352, 552 of FIGS. 3 and 5, are capable of fasteroperations, e.g., read row of data from disk space, by relieving a localoperating system 1320 of certain long operations which cannot beinterrupted, such as writing rows of data to disk or deleting largefiles. In some embodiments, the swarm system 352, 552 prevents longoperations by the local operating system 1320 by reducing someoperations into more digestible pieces for the operating system 1320.Instead of using the conventional delete function 1350 of the localoperating system 1320, which can take many seconds for a multi-gigabytefile, the swarm system 1300 move files needing deletion to a trashdirectory 1312, which is some designated space on the respective node. Atrash daemon 1310 comes along later and slowly truncates one or morelarger delete files to smaller and smaller sized file pieces 1340, adelete process known as a polite unlink. The polite unlink operation isa user level function which opens the file, and essentially divides upthe delete operation into small chunks such that the delete operationwould not monopolize use of the disk for a long time. When the one ormore delete files have been reduced, the local operation system deletesthe smaller file pieces 1340 faster using its conventional deletefunction 1350 to remove the file 1330. The trash daemon 1320 managesmost file deletions. In some embodiments, the large file 1330 is renamedinto the trash directory 1312, and later the trash daemon 1310 comealong and politely unlinks it instead of the local operating system1320. Thus, by using the trash daemon 1310 to delete files relieves thelocal operating system 1320 to allow, for example, reads from otherprocesses (e.g. to respond to a user web search) to be completed fasterin the swarm system 1300 for faster response time.

Mapjob

FIG. 13B illustrates a parallel mapjob process in system 1301 servicingtwo nodes 1313, 1315 according to some embodiments. A mapjob is aparallel program which runs efficiently by processing a complete tableby dividing the work into “shards” 1323, 1325 to improve execution time.Each shard 1323, 1325 reads the appropriate piece of the table fromlocal disk, shown as buckets 1317, 1319. For example, a mapjob on thedatabase system 1301 has at least two shards 1323, 1325. In the example,Shard 2 1323 is run on Node 1 1313, directly reading the contents ofBucket 2 1315 a from local disk. Shard 3 1325 is run on Node 2 1315,directly reading the contents of Bucket 3 1317 b from local disk. Amapjob usually generates an answer by either setting data in thedatabase, or by returning data to the main process. Most other systemsdoing similar things are called “MapReduce” because they have only oneway to return the answer by returning data to the main process. Mapjobs,however, allow for multiple ways to return the answer. The ability for amapjob to write immediately into the database means that partial resultsfor the mapjob are available immediately to a reader, and also that anyreductions (expressed with combinators) can be computed overlapped withthe map computation.

In some embodiments, mapjob uses combinators, which are described in thenext section, to do the reduction instead of an explicit reduce phase.Combinators are remote atomic operations which can be used, among otheruses, to take pieces of data from many nodes and combine them into asingle answer. For example, the “add” combinator in a mapjob may be usedto compute the sum of a single column over all rows of a table. Thesecombinator “reductions” can either be done to return data to the calleror to set data in the database. Mapjobs may be computed as a mapjobdescribed above or, alternatively, computed acting on a stream of datacoming in over a period of time, such as webpages being crawled.

Another interesting aspect of a mapjob doing reduction to the databaseinstead of to the caller is that the reduction workload can be spreadover the life of the mapjob, instead of concentrated at the end. Thisleads to better performance. Additionally, mapjobs are anotherfault-tolerant aspect of the swarm system 350, 500. A “shard” of amapjob will be re-run on a different node containing the appropriatebucket if a disk or node failure causes a shard, such as shard 1323,1325, to fail to complete.

D. Combinators Overview

FIG. 14A lists several combinator tools 1408 that may be stored asapplications 1838 in memory 1822 of FIG. 18, according to someembodiments. The combinators 1408 will be described in further detail inlater sections. The combinators 1408 may be utilized in a variety ofdatabase and search operations, and are described in detail in varioussections. Combinators 1408 may include, but are not limited to, thefollowing:

Logcount 1422—approximates the count of unique items in a set of items.

TopN 1424—ranks data items, keeping only the N highest ranked.

Set( ) 1426—takes the last value seen as the answer.

Append 1428—append a string into the end of an existing string.

Comb_Add 1430—add a value to the existing value.

FIG. 14B is a block diagram illustrating an add combinator for a node1410 in a distributed database system, such as swarm system 350, 500, inaccordance with some embodiments. In some embodiments, combinatorscombine tasks at many different levels of the swarm system 350, 500,which reduces the amount of data transferred across the network andwritten to disk. For example, consider an “add” combinator illustratedin FIG. 14B. For a given number of requests to add to a value in a rowstored in disk 1412 of node 3 1410, a first request at a first process1438 (P1) represents an add +1, to the row in disk 1412. Another process1442 represents another add +1. Thus at some level (here the node N11432), the adds are combined to be a single combined operation of add+2. The summed request is received by a request processor, such as abucket daemon 1414 of node 3 1410. In some embodiments, more than oneadd for the row in disk 1412 are received from a single process, such asshown by P3 1458 and P4 1462. There are add +3 process P3 1458 and add+4 from process P4 1462. Therefore, the sum of requests received by nodeN2 1452 equals add +7. Add requests may, therefore, come from differentlocation (e.g., N1, N2), but are combined by bucket daemon 1414.Consequently, the bucket daemon 1414 receives a total of add +9 for thevalue in the row stored in disk 1412. Combining the operations reducesthe resources needed to update the value.

Combinators in Three Bucket Replication

FIG. 15 is a block diagram illustrating combinators used for writes tothree bucket replications (in nodes 1510 a-c) in distributed databasesystem, such as swarm system 500, in accordance with some embodiments.Process 1538 in a Node 1 1530 includes two write requests to add to agiven row and column of a table to send to a write daemon 1532 whichmight succeed in finding more adds to the same row and column of thesame table and combining them. Process P2 1542 in Node 1 1530 alsoincludes add +3 to the same row. Thus, total adds to write daemon 1532is add +5. Similarly, process P3 1558 has add +2 and process P4 1562includes add +4 to the same row. Thus, add +6 are received by a writedaemon 1552 of Node 2 1550. The adds are sent to several remote bucketdaemons 1514, 1518, 1520 (one per replica), which in turn combine moreoperations in memory until the data is written to disk. The bucketdaemons 1514, 1518, 1520 at respective three nodes 1510 a-c receive theadds. Thus, each bucket daemon 1514, 1518, 1520 writes a total of add+11 to respective Inc files 1504, 1506, 1508.

Due to all of these combinations, millions of add operations on thecluster to the same column and row in a table might result in only a fewor perhaps a single disk transaction.

Combinators can be stored in the database in several ways. One way is tostore a combinator as a column in a row of the database. The other is tohave the combinator be embedded in a complex datastructure such as aPerl hash or Python dictionary which is stored in a column in a row ofthe database. There is a special combinator, comb_hash, which is a Perlhash or Python dictionary containing other combinators such as comb_addor comb_logcount.

Combinators also exist as objects in ordinary variables, i.e. they canbe Perl or Python variables.

Deleted values are represented by a special combinator, comb_delete,whose role is somewhat similar to “tombstones” in Casandra.

In some embodiments, the time that a combinator was created is recordedand is used to determine which value is chosen when situations arisesuch as 2 comb_sets or a comb_set and a comb_delete or a series ofcomb_adds and a comb_set done to the same value. This aids determinismof combinator calculations. For example, if the operations beingcombined are a comb_set to zero at 11:00 am, and a comb_add +1 at 10:35am, then the result would be comb_set of zero at 11 am.

In some embodiments, the clocks of the nodes in the cluster arecarefully synchronized using a protocol such as NTP (the network timeprotocol) in order to facilitate the process described in the precedingparagraph above.

Set( ) Operations

The use of combinators has been implemented for a very large number ofoperations in our system besides add. One such use is “set( )”. The set() combinator 1426 takes the last value seen as the answer. Because set() can be written as a combinator, it uses all of the combinatorinfrastructure available in the system. With most databases, if 10processes on 100 nodes set 1,000 different values into a given row andcolumn of a particular table, there will be 1,000 RPC calls made fromthe nodes to the database server, each resulting in a write into atransaction log. In contrast, the writer daemons 1532, 1552 on nodes1530, 1550 may combine the 10 local set operations into one, and thebucket daemons 1514, 1518, 1520 on the nodes 1510 a-c with replicas ofthis bucket may combine the 100 incoming set( ) operations into a singleset( ), resulting in one disk transaction. This is much higherperformance.

In some embodiments, combinators 1408 may be combined with differentcombinators 1408 in some cases, e.g. a cell might be operated on by bothset and add combinators 1426, 1430. If both combinators are associative,e.g., comb(comb(a,b),c)=comb(a,(comb(b,c)), then the combinators can beused together.

TopN

FIG. 16A is a diagram of a data structure illustrating a TopN ranking1603 according to some embodiments. A single item sent into a TopN 1603,as shown in FIG. 16A is a tuple of (name, rank, extra), where ‘name’ isa scalar variable (string, number, etc), ‘rank’ is a number (larger isbetter), and ‘extra’ is an arbitrary data structure optionally used torecord additional information about ‘name’. The value of N sets a boundon the memory usage of the TopN 1603. Example usages of TopN 1603include: remembering the N most important (highest ranked) webpagesmentioning the word ‘Obama’, or remembering the latest N webpagescrawled mentioning the word ‘Obama’. In this last example, the “rank” ofthe webpage is the time that the webpage was crawled. A larger timevalue indicates more recent crawls.

Logcount

FIGS. 16B-16C illustrates various embodiments of a Logcount structure1600 resulting from the Logcount combinator 1422 and a process 1601 in adistributed database system, such as swarm system 350, 500, inaccordance with some embodiments. Logcount 1422 solves the problem ofgetting an approximate count of unique items in a set of items, using asmall amount of memory. For example, Logcount 1422 may be used to countthe number of incoming links to a website. There might be 0 or 1 suchincoming links, or millions of incoming links for a site such asyahoo.com. It is desirable to count these links without having to storeall of them. By only counting the unique incoming links, the data can bere-processed repeatedly while still keeping an accurate count of theunique incoming links.

The problem of counting unique items, such as visited websites, wastypically addressed by a technique called a “Bloom filter”, whichrequires megabytes of storage to give an accurate answer when presentedwith billions of items. Logcount 1422, however, is a less accuratemethod that uses much less memory. In one embodiment, billions of uniqueitems can be counted to an accuracy of roughly +−50% using only 16 bytesof storage. This small storage size makes it possible to logcount manyseparate kinds of data with fewer resources than using a Bloom filter touniquely count just one kind of data. Additionally, Logcount 1422 can beused in both MapJobs and incrementally.

A process 1601 illustrated in FIG. 16C is one example where Logcount1422 can be used to count a set of M input values v1,v2, . . . vM. Atstep 1630, each input value is hashed into a hashed value h1,h2 . . .hM. The logcount algorithm uses N pieces of intermediate data i1,i2, . .. , iN. Before counting any items, i1 . . . iN are zero. To count thefirst hashed value h1, at step 1635, the hashed value h1 is divided intoN parts h1_1 . . . h1_N. In some embodiments, the hash h1 contains 128bits and if N=4, each part is 32 bits. The intermediate values i1 . . .iN in this embodiment are also 32 bits each, so the total intermediatestorage needed by Logcount in this embodiment is 128 bits.

For each part of the first hashed value h1_1 . . . h1_N, at step 1640,the lowest bit set is found. For example, if h1_1=6, or 0110 in binary,the lowest bit set is the second bit. In step 1645, the same bit is setin the first intermediate value i1. Steps 1640 and 1645 are repeated foreach of the N pieces of the hashed value h1. Finally, the steps startingat 1635 is repeated for each hashed value h2,h3, . . . , hM until allthe hashed values are counted.

To compute the output count C given the intermediate values i1 . . . iN,a log variable k is computed at step 1660. To compute k, the lowestunset bit in each intermediate value i1 . . . iN is found. For example,if i1=0111011111, the lowest unset bit is 6. At step 1664, these lowestunset bit values are averaged together for all i1 . . . iN.

The final output value is then determined at step 1665 by the equationC=2{circumflex over ( )}(k−1).

The key to understanding this algorithm mathematically is that thelarger bits in i1 . . . iN are less likely to be set than the smallerbits. Logcount 1422 is analogous to throwing darts at a dartboard asshown in FIG. 16B 1610-1620, where instead of similar-sized targets,each box is ½ the size of the box before it. Half of the time the dartwill hit the biggest box 1610, and a small fraction of the time the dartwill hit one of the tiny boxes 1620. After a few throws, all of thelarge boxes 1610-1616 will have been hit, but there will be tiny boxes1620 which have not been hit yet. The smaller the box which has not beenhit, the larger the count. This method is only an approximation to thecount, and the error in the count can be quite large. However, to makethe count C more accurate, N separate dartboards i1 . . . iN aremaintained, and their counts are averaged together.

Continuing with the dartboard analogy, in contrast, a Bloom Filter islike a dartboard with equal-sized boxes. So the number of boxes must beextremely large to count a large number of darts, using much morestorage than Logcount 1422 does.

Finally, note that if the hashed value h1 is counted again, it will setbits in i1 . . . iN which are already set, resulting in no increase inthe count.

In some embodiments, to make the logcount more accurate, N can beincreased, and the size of i1 . . . iN can be increased to 64 bits ormore. As an example, a variant called logcount64 may be created, whichhas N=64 and i1 . . . iN sized as 32 bits. A variant algorithm thatgives more accuracy for very small counts is used to record the exactanswer for very small counts by storing the keys themselves (or theirhashes) into the storage bytes that normally would be used to record i1. . . iN. A flag indicates when this is done. If the count increases tothe point where no more storage is left, then the algorithm switches tousing normal logcount.

Logcount, as described, is expressed in powers-of-two, thus all of theoperations may easily be expressed in binary arithmetic, which is veryfast. In some embodiments, another variant is to use a factor other than½ to determine which bits are set in i1 . . . iN. This can be thought ofas having the boxes 1610-1620 in FIG. 16B decrease in size other than bya factor of ½. A factor of 9/10, for example, would require the size ofi1 . . . iN to be increased to be able to store a count of up to 4billion unique keys, but the count would be more accurate.

In some embodiments, additional variations are implemented, for examplewhere the accuracy of an estimator (count) of a given bit is dependenton an arbitrary exponential decay C. Logcount 1422 is an amazinglyuseful tool given its ability to fairly accurately estimate the numberof unique strings. However, Logcount 1422 may be limited by the maximumnumber that it can count to. For example, a maximum Logcount value of2³² is generally useful for quick results, and is selected because ofthe popular use of 32-bits. But, after 4 billion counts or more,Logcount at this size is no longer useful. Logcount 1422 may also belimitation in the size/accuracy trade-off. It is found that a storagecapacity of 32 bytes allows Logcount 1422 to store numbers (counts) withaccuracy in the +/−50% range. However, some variations, as describedabove, may include systems that require greater or lesser accuracy. Inorder to allow for greater flexibility, Logcount 1422 may be constructedwhere the probability of a given bit is no longer 50%, but an arbitraryexponential decay. This complicates the evaluation of the logcount(primarily through the “holes” in the bit pattern that are now likelynot only to exist and carry useful information), but allows forbalancing maximum count and size/accuracy trade-offs on a per-estimatorbasis, as described further in the next section.

In some embodiments, Logcount 1422 may be modified by havingrequirements for an exponential decay factor ∈ (introduced above). As inother Logcount variations, a good digest (hash) function is firstneeded, where d(string)→[0,1). Given ∈ the bit is set in a bit vector,defined as:

$i = \left\lfloor \frac{\ln\left( {1 - {d({string})}} \right)}{\ln\left( {1 - \epsilon} \right)} \right\rfloor$where i is an intermediate data value in a set of intermediate valuesfor a count algorithm. Thus, for a given string the followingprobabilities that any given bit will be set are:p(b ₀)=∈p(b ₁)=∈(1−∈). . .p(b _(i))=∈(1−∈)^(i)

Also, for convenience in later sections, a second variable f_(i) isdefined as:f _(i)=∈(1−∈)^(i)

Combining these bit vectors i is as simple as a bitwise “or”.

Given the definitions above, a given bit vector may now be used toestimate the number of unique strings that went into its creation. Thisis done through modeling the probability of a bit vector given a numberof unique strings, and maximizing the log-likelihood with respect to thenumber of unique strings.

First consider the effect of putting S unique strings into the bitvector. The probability that a bit is not set is then:p(˜b _(i) |S)=(1−∈(1−∈)^(i))^(S)=(1−f _(i))^(S)

And therefore, the probability that a given bit is set is:p(b _(i) |S)=1−p(˜b _(i) |S)=1−(1−∈(1−∈)^(i))^(S)=1−(1−f _(i))^(S)

So the probability of a given bit string given S unique strings wouldbe:

${p\left( {b_{0},b_{1},\left. {\ldots\mspace{14mu} b_{n}} \middle| S \right.} \right)} = {\prod\limits_{i = 0}^{n}{{p\left( b_{i} \middle| S \right)}_{i}^{b}{p\left( {\sim b_{i}} \middle| S \right)}^{1 - b_{i}}}}$

And the log-likelihood is:

$\begin{matrix}{{\ln\left( {p\left( {b_{0},b_{1},\left. {\ldots\mspace{14mu} b_{n}} \middle| S \right.} \right)} \right)} = {{\sum\limits_{i = 0}^{n}{b_{i}{\ln\left( {p\left( b_{i} \middle| S \right)} \right)}}} + {\left( {1 - b_{i}} \right){\ln\left( {p\left( {- {b\;}_{i}} \middle| S \right)} \right)}}}} \\{= {{\sum\limits_{i = 0}^{n}{b_{i}{\ln\left( {1 - \left( {1 - f_{i}} \right)^{S}} \right)}}} + {\left( {1 - b_{i}} \right){\ln\left( \left( {1 - f_{i}} \right)^{S} \right)}}}} \\{= {{\sum\limits_{i = 0}^{n}{b_{i}\;{\ln\left( {1 - \left( {1 - f_{i}} \right)^{S}} \right)}}} + {{S\left( {1 - b_{i}} \right)}{\ln\left( {1 - f_{i}} \right)}}}}\end{matrix}$

Maximizing log-likelihood with respect to the number of unique stringsresults in:

${\frac{d}{d\; S}{\ln\left( {p\left( {b_{0},b_{1},\left. {\ldots\mspace{14mu} b_{n}} \middle| S \right.} \right)} \right)}} = {{\sum\limits_{i = 0}^{n}{b_{i}\frac{{- \left( {1 - f_{i}} \right)^{S}}{\ln\left( {1 - f_{i}} \right)}}{1 - \left( {1 - f_{i}} \right)^{S}}}} + {\left( {1 - b_{i}} \right){\ln\left( {1 - f_{i}} \right)}}}$$\mspace{20mu}\begin{matrix}{0 = {\frac{d}{d\; S}{\ln\left( {p\left( {b_{0},b_{1},\left. {\ldots\mspace{14mu} b_{n}} \middle| S \right.} \right)} \right)}}} \\{= {{\sum\limits_{i = 0}^{n}{b_{i}\frac{{- \left( {1 - f_{i}} \right)^{S}}{\ln\left( {1 - f_{i}} \right)}}{1 - \left( {1 - f_{i}} \right)^{S}}}} + {\left( {1 - b_{i}} \right){\ln\left( {1 - f_{i\;}} \right)}}}} \\{= {\sum\limits_{i = 0}^{n}{{\ln\left( {1 - f_{i}} \right)}\left( {\left( {1 - b_{i}} \right) - {b_{i}\;\frac{\left( {1 - f_{i}} \right)^{S}}{1 - \left( {1 - f_{i}} \right)^{S}}}} \right)}}} \\{= {\sum\limits_{i = 0}^{n}{{\ln\left( {1 - f_{i}} \right)}\left( {1 - {b_{i}\left( {1 + \frac{\left( {1 - f_{i}} \right)^{S}}{1 - \left( {1 - f_{i}} \right)^{S}}} \right)}} \right)}}} \\{= {\sum\limits_{i = 0}^{n}{{\ln\left( {1 - f_{i}} \right)}\left( {1 - {b_{i}\;\frac{1}{1 - \left( {1 - f_{i}} \right)^{S}}}} \right)}}} \\{= {{\sum\limits_{i = 0}^{n}{\ln\left( {1 - f_{i\;}} \right)}} + {\sum\limits_{i = 0}^{n}{b_{i}\;\frac{\ln\left( {1 - f_{i}} \right)}{1 - \left( {1 - f_{i}} \right)^{S}}}}}}\end{matrix}$which separates out a constant term from a sum over the set bits. Thisroot can be discovered with Newton's method to a reasonableapproximation.

In choosing ∈, given a length in bits N, and a desired maximum count toreasonably estimate M, then estimator runs out of bits when:

$\left( {1 - \epsilon} \right)^{N} = \frac{1}{M}$

Which means the optimal ∈ would be:

$\epsilon = {1 - \left( \frac{1}{M} \right)^{\frac{1}{N}}}$

It will be appreciated that one or more of the Logcount variationsdescribed in the preceding sections may be combined. Furthermore, otherLogcount algorithms and methods known in the art may be utilized in theswarm system 350, 500, or utilized in combination with any of theLogcount variations described in this document. For example, one or moreLogcount concepts from the following list may be utilized:

-   -   “Probabilistic Counting Algorithms for Data Base Applications,”        Philippe Flajolet and G. Nigel Martin, Journal of Computer and        System Sciences, 1985;    -   “Loglog Counting of Large Cardinalities,” Marianne Durand and        Philippe Flajolet, ESA 2003, LNCS 2832, pp. 605-617, 2003; and    -   “Fast and Accurate Traffic Matrix Measurement Using Adaptive        Cardinality Counting,” Min Cai, Jianping Pan, Yu-Kwong Kwok, Kai        Hwang, Proceedings of the 2005 ACM SIGCOMM workshop on Mining        network data.

The generalized concepts of Logcount in the above papers may be utilizedin any manner known to an ordinary person skilled in the art in theswarm system 350, 500, or other similar distributed databases systems(e.g, search engines), and are hereby incorporated by reference.

E. Subset Mapping

FIG. 17A is a block diagram illustrating a data structure, as shown inNode 1 1702 for mapping subsets of data in accordance with someembodiments. Mapping subsets of data may be utilized in situations wheresome workload or set of tasks must be executed such that each node 1702,1710, 1720 should hold a unique, unduplicated portion of the rows in atable. In such conditions, the entire table should be serviced, no rowsshould be duplicated between nodes 1702, 1710, 1720, and theorganization should be adjusted if nodes 1702, 1710, 1720 come or go(due to machine crashes, new servers added, and so on.)

In a “parition ranges” protocol, active nodes, such as nodes 1702, 1710,1720, are sorted in the cluster, for example, by IP address. The digestrange (which is 0-2{circumflex over ( )}128-1) is divided, and portionsof the digest range are allocated to nodes 1702, 1710, 1720 based ontheir position in the sorted IP address list. The lowest numbered node1702, 1710, 1720 starts a digest 0 and go up to some value a (N1 1704).The next server starts at digest a+1 and go up to some value b (N2,1706), and so on, up to the end of the digest range, N3 1708.

Each node 1702, 1710, 1720, thus, knows which rows of the table it isassigned to by checking to see if they lie within its partitioned digestrange. The 1702, 1710, 1720 do not have to communicate with each otherbeyond the normal communication to know which ranges they areresponsible for.

The rows of the table that a node is responsible for are not necessarilylocated on a bucket hosted on that node 1702, 1710, 1720, so they willlikely have to be fetched from the network. Also, when the map changes(a new node 1702, 1710, 1720 comes up or goes down), all of theboundaries move. Every node 1702, 1710, 1720 in the cluster is affectedby any changes to the server map.

FIG. 17B shows a localized management of a subset of the map at nodes1711-1719 in a distributed system 1701 according to some embodiments. Aconsistent first replica of a set of replicas subset of the map isdesired such that each node 1711-1719 may identify a subset of its localbuckets. The total set of such first replica identified buckets formscomplete coverage of the map—each bucket will occur once and only once.

This is achieved for each three replicas of buckets 1725-1731,identifying the nodes 1711-1719 the bucket resides. In a three replicasystem, the first replica map at each node 1711-1719 will on averageinclude one-third of the buckets. The three buckets are consistentlyordered according to some sorting by IP address, hashes of the bucketnumbers and so on. Thus, the first node Node 1 1711 is assigned thebuckets 4-6 (1725 a, 1727 a, 1729 a), the second node Node 2 1713 isassigned the buckets 5, 7, 6 (1727 b, 1729 b, 1731 a) and so on, suchthat each node 1711-1719 is responsible for its own set of buckets.

This configuration allows for a single replica subset of data on eachnode 1711-1719 to be locally available on disk, and does not need to befetched over the network. Furthermore, if the server map changes, onlysome of the subsets of buckets will change. Some nodes 1711-1719 will nolonger be responsible for some buckets they were previously in charge ofdue to reassignment. Some nodes 1711-1719 will have responsibility fornew replica buckets. However, the “churn” within the overall databasesystem is minimized—many nodes will not have any changes (either firstreplica bucket additions or deletions) occurring to them. This localizedmanagement system is in contrast to partition ranges, where a hostaddition or exit causes all of the nodes 1702, 1710, 1720 in the clusterto have to adjust the rows they are responsible for. There are otherfirst replica maps possible. Hashing and sorting are used so each node1711-1719 may locally determine the total first replica map of a set ofbucket replicas in such a way that if everyone does this process, theyall arrive at the same first replica map without needing to talk to eachother.

Several algorithms have been explored for distributing the buckets in afirst replica subset map given an existing three-replica map. Onealgorithm attempts to make the number of first replica buckets as evenas possible across all the hosts. Such an algorithm has the benefit ofload-balancing the work evenly across the hosts. This algorithm couldalso be updated to make the distribution as even as possible withrespect to a weighted hostlist, with the weights representing e.g. therelative CPU power or disk bandwidth of the hosts, or the amount ofmemory in the hosts.

Another algorithm considered distributes the first replica buckets sothat the minimum number of first replica buckets need to be moved whenthe three-replica map changes due to a host or disk addition or failure.Yet another algorithm considered attempts to give good load balancingwhile simultaneously keeping the number of first replica bucket copiesto a low number when the three-replica map changes.

In order to be able to successfully copy combinators without losinginformation, both the ability to get the “raw data” of a combinator andthe normal value of the combinator are provided. In the case of alogcount combinator, the “raw data” is the 16 bytes, while the “normalvalue” is the integer approximate count.

The comb_bloom combinator is used to efficiently compute Bloom Filters.For example, a 1024-bit bloom filter b1 is combined with anothersame-size bloom filter b2 by “or”-ing the bits. In a search enginecontext, comb_bloom can be used to determine if an URL might have beencrawled before.

The comb_avg combinator stores the average of the numbers sent into it.comb_avg weight compute the weighted average of the numbers sent intoit. In a search engine context, comb_avg could be used in a mapjob tosum a column of a table, such as the average rank of all webpages knownto the search engine.

The comb_eavg combinator stores an exponentially-decaying average, whereadding a new value multiples the old value by (1-decay_rate). Forexample, if the decay rate is 0.5, sending in the value 1 10 times in arow results in a value of 1+1/2+1/4+ . . . +1/1024=2047/1024.

The comb_escore combinator is an exponential decay in time. Each valueis sent in with a time, and the old value is decayed as necessary. Forexample, if the decay rate is 0.5, and the new value is 10 seconds newerthan the old value, the old value will be divided by 1024 before beingadded to the new value.

comb_index

Comb_index is a special form of TopN used for the list of webpages thatare good for a each search term or bi-gram. The “rank” is the quality ofthe match, or the date. The “key” is data compressed using thecompression scheme below, including the URL of the webpage, and facetand other information used to quickly evaluate if an URL matches anoperator. It is important for the size of this compressed data to besmall enough to fit long lists of webpages for every possible searchterm into ram or flash disk or other fast storage devices.

In a search application, several separate comb_index combinators arekept for each word or bi-gram indexed. For example, for the word‘Lindahl’, there is one comb_index ranked by rank with the highestquality webpages for ‘Lindahl’. There is also one comb_index ranked bychrondate, containing the most recent chrondate-containing webpages for‘Lindahl’. Answering the query “Lindahl” consults the first comb_index;answering the query “Lindahl/date” consults both. For the date-sortedquery, the second combinator contains the most recent webpages forLindahl without regard to quality, and the first combinator adds inolder but highly-ranked webpages for Lindahl. A 3rd comb_index storesthe most recent webpages with ‘Lindahl’ in the anchortext, title, orURL; this is a higher-quality subset of all the pages mentioningLindahl, and will go back farther than time than the list of all pagesmentioning Lindahl.

There are also comb_index combinators for the most important operators.As an example, the ‘gov:obama’ comb_index contains the most importantwebpages for Obama matching the /gov facet. And there is a plain ‘gov:’comb_index used to answer a plain “/gov” query. Some of these operatorcomb_index combinators use chrondates as the rank.

To get more parallelism into answering queries, each comb_index caninstead be represented by N comb_index combinators, known as “slices”.For example, instead of having only an ‘obama’ comb_index, there wouldbe 8 comb_indexes named ‘0:obama’, ‘1:obama’, . . . , ‘7:obama’. Theparallel benefit comes when these sliced comb_index combinators arefetched with get( ): N bucket daemons or N ram daemons are used insteadof only 1.

In some embodiments, the comb_index combinator contains an additional“tail” of even more highly compressed data. For example, if the fullcompressed data for each webpage is 32 bytes, and the tail data is only4 bytes, some information about 9 times as many webpages can be storedin only 2 times the size. However, 4 bytes is so small that it cannotuniquely identify the URL, or store rank or facet information. Instead,these 4 byte quantities are picked to be 4 bytes out of the 8 bytehashed value of the URL. These 4 bytes can't be mapped directly to theURL, but, if the same URL exists in the “head” of another comb_indexbeing consulted in the query, it is likely that a matching 4 bytes isreferring to the same webpage.

For example, consider the query “Greg Lindahl”. Greg is a common firstname and Lindahl is a rare last name. Assume that there isn't acomb_index combinator for the bi-gram “Greg Lindahl”. To answer thequery, fetch the comb_index combinators for “Greg” and “Lindahl”. Assumefurther that the URL for Greg Lindahl's homepage (GLHP) is in the headof “Lindahl” and the tail of “Greg”. When intersecting these two liststo find pages mentioning both “Greg” and “Lindahl”, we note that the 4byte quantity for GLHP in the tail of “Greg” happens to match the 4bytes from the hashed URL of GLHP in the head of “Lindahl”. Then we canguess that GLHP contains both words “Greg” and “Lindahl”. The facets forGLHP are found from the head entry in “Lindahl”; we do not know the rankof GLHP for the word “Greg”, but we store the average rank of thewebpages in the tail of “Greg”, and can use that as an approximation.

The benefit of “tails” for multi-word and many-word queries is actuallyeven greater than getting 9× data into 2× the space, because ofcombinatorial effects.

comb_TopN

A TopN variant comb_TopN uses logcount (or any other combinator) toreplace the rank. For example, assume it is desired to compute the mostimportant incoming link anchortext by uniquely counting the number ofincoming links use a given anchortext, and remembering the top N ofthese. The input data for webpage http://skrenta.com/ would looksomething like:

Rich Skrenta: <logcount of URLs with this anchortext=about 10,000 uniqueincoming urls>

Richard Skrenta: <logcount of URLs with this anchortext=about 500 uniqueincoming urls>

First Virus Inventor: <logcount of URLs with this anchortext=about 2unique incoming urls>

Because logcount data is small, it is cost-effective to do this forevery webpage on the entire Internet. Also because logcount countsunique items, the webpages can be crawled repeatedly and these logcountscan be updated without double-counting anything.

F. Compression Compression Method 1

The database described in this patent is the type of database known as‘schema-free’. Schema-free databases are extremely flexible, but cansuffer from data size bloat because the names and types of the columnsneed to be somehow stored in each row. In contrast, a schema-baseddatabase only needs to store this information once for an entire table.Also, a schema-based database that knows that a given column exists inevery row of a table can compress it: for example, a boolean variablecan be represented by 1 bit. In a schema-free database, the usualimplementation requires storing the name of the Boolean column, itstype, and its value in every row of the database that it exists.

In order to compress a schema-free database as much as a schema-baseddatabase, we have built a special purpose compression engine which isdriven by a versioned ‘compression table’ of column names and types. Anycolumn name in the actual data which is found in the compression tablecan be compressed. Any column name which does not appear in thecompression table can be stored as a (name, type, value) triple. Theversion number allows the compression table to evolve over time as thedata evolves. The compression subroutine can use whatever versionproduces the smallest output. The decompression subroutine can useknowledge of all of the versions in the compression table to decompressanything generated by the compression subroutine.

As an example, consider this compression table:

Compression Table 1 version 1 column name: column type: ‘name’ shortstring ‘age’ small integer version 2 ‘first_name’ short string‘last_name’ short string ‘age’ small integer

Example 1 input:

name ‘Greg Lindahl’

age 39

To compress input Example1, the compression routine determines thatusing version 1 from the compression table will give the smallestoutput.

An example embodiment of the output would be:

compression table ID, 2 bytes, value 1

version, 2 bytes, value 1

first fixed column: ‘name’, short string

-   -   length, 2 bytes, value 12        -   value, 12 bytes, value ‘Greg Lindahl’

second fixed column: ‘age’, small integer

-   -   value, 2 bytes, value 39

count of additional columns, 2 bytes, value 0

The total length of this is 20 bytes. (The byte lengths chosen for thesedatatypes and the examples below are arbitrary and are given forillustration only.)

The reason for this small size is that the names and types of thecolumns (‘name’, ‘age’) are specified by the compression table ID andversion, and don't have to be stored in the compressed output. Thedecompression subroutine would be able to consult its copy of thecompression table to look for the fixed columns in the same order asemitted by the compression subroutine.

Example 2 input:

extra ‘Blekko’

first_name ‘Greg’

last_name ‘Lindahl’

age 39

In the second example, the compression routine sees that the input willbe best compressed by version 2, with one column ‘extra’ not present asa fixed column name.

compression table ID, 2 bytes, value 1

version, 2 bytes, value 2

first fixed column: ‘first_name’, short string

-   -   length, 2 bytes, value 4        -   value, 4 bytes, value ‘Greg’

second fixed column: ‘last_name’, short string

-   -   length, 2 bytes, value 7        -   value, 7 bytes, value ‘Lindahl’

third fixed column: ‘age’, small integer

-   -   value, 2 bytes, value 39

count of additional columns, 2 bytes, 1

column name length, 2 bytes, value 5

column name value, 5 bytes, value ‘extra’

column type, 2 bytes, short string

column value length, 2 bytes, value 6

column value value, 6 bytes, value ‘Blekko’

The total size of this compressed structure is 40 bytes.

An example representation of an uncompressed storage embodiment for thesame input data for Example 2 would have to record a (name, type, value)triple for each column present in each row:

count of triples, 2 bytes, value 4

column name length, 2 bytes, value 5

column name value, 5 bytes, value ‘extra’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 6

column value data, 6 bytes, value ‘Blekko’

column name length, 2 bytes, value 10

column name value, 10 bytes, value ‘first_name’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 4

column value data, 4 bytes, value ‘Greg’

column name length, 2 bytes, value 9

column name value, 9 bytes, value ‘last_name’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 7

column value data, 7 bytes, value ‘Lindahl’

column name length, 2 bytes, value 3

column name value, 3 bytes, value ‘age’

column type, 2 bytes, short integer

column value, 2 bytes, value 39

This adds up to 70 bytes, and as you can see this is much larger thanthe Example 2 data compressed using compression table 1.

Compression Method 2

A drawback of Method 1 is that compression tables and versions must beconsistently distributed to all potential decompressors of data, andthere could potentially be an extremely large number of them in a bigdatabase with many database tables that evolve over time. As analternative, a ‘numbered short string table’ could be used to compresssome of the ‘short strings’ in the data. Since column names are shortstrings, this could be very effective using only a single table ofnumbered short strings to compress all of the database tables. Also,some of the column values might be short strings found in the numberedshort string table, and thus would also be compressed.

As time passes, the database administrator or an automated system wouldbe able to append new short strings to the numbered short string tableas new short strings become common enough to benefit from compression.Strings cannot be removed or renumbered in the table unless it is knownthat no compressed data refers to these particular strings, as thiswould cause old compressed data to be destroyed.

An example embodiment of this technique on the input data from Example 2above is given below. The fact that a given short string should belooked up in the numbered short string table is indicated by the highbit of the short string 2-byte length being set.

The Numbered Short String Table:

‘Greg’ 1 ‘Lindahl’ 2 ‘Greg Lindahl’ 3 ‘name’ 4 ‘first_name’ 5‘last_name’ 6 ‘age’ 7 ‘Blekko’ 8

The representation of the compressed data:

count of triples, 2 bytes, value 4

column name length, 2 bytes, value 5 (high bit not set)

column name value, 5 bytes, ‘extra’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 6+high bit set

column value data, 2 bytes, value 8, corresponding to ‘Blekko’

column name length, 2 bytes, value 10+high bit set

column name value, 2 bytes, value 5, corresponding to ‘first_name’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 4+high bit set

column value data, 2 bytes, value 1, corresponding to ‘Greg’

column name length, 2 bytes, value 9+high bit set

column name value, 2 bytes, value 6, corresponding to ‘last_name’

column type, 2 bytes, short string

-   -   column value length, 2 bytes, value 7+high bit set

column value data, 2 bytes, value 2, corresponding to ‘Lindahl’

column name length, 2 bytes, value 3+high bit set

column name value, 2 bytes, value 7, corresponding to ‘age’

column type, 2 bytes, short integer

column value, 2 bytes, value 39

This corresponds to a compressed length of 43 bytes.

Compressing Inside a Column

The above techniques can also be used to compress a structured columnvalue. In the BlekkoDB, the contents of a column value can begeneralized data structure such as a perl hash or python dictionary.

Generalization of Compression Methods

The compression examples above used a limited set of datatypes. In amore general system a Numbered Table for other datatypes such asIntegers or Floating Point Numbers could be used. This would be usefulin cases where an integer for floating point field had only a limitedrange of values, e.g. the number of telephone area codes found in theUSA is less than 256, so a Numbered Integer Table could be used torepresent them.

The compression examples above used the high bit of a sort string lengthfield to signal that the data should be looked up in a Numbered ShortString field. Another way to represent this would be to use a differenttype, a Numbered Short String type, to indicate the table lookup isneeded. This is very useful for types which do not have an encodedlength, such as integers.

G. Server System

FIG. 18 is a block diagram illustrating an embodiment of a server system1800 according to embodiments. The server system 1800 may include atleast one data processor or central processing unit (CPU) 1810, one ormore optional user interfaces 1814, a communications or networkinterface 1820 for communicating with other computers, servers and/orclients, a memory 1822 and one or more signal lines 1812 for couplingthese components to one another. The user interface 1814 may have akeyboard/mouse 1816 and/or a display 1818. The one or more signal lines1812 may constitute one or more communications busses.

The memory 1822 may include high-speed random access memory and/ornon-volatile memory, such as one or more magnetic disk storage devices.The memory 1822 may store an operating system 1832, such as LINUX, UNIXor WINDOWS, that includes procedures for handling basic system servicesand for performing hardware dependent tasks. The memory 1822 may alsostore communication procedures in a network communication module 1834.The communication procedures are used for communicating with clients,such as the clients 110 (FIG. 1), and with other servers and computers.

The memory 1822 may include a broadcast protocol 1836 for communicatingwith other servers and/or machines in a distributed database system. Forexample, the broadcast protocol 1836 may be relied upon to integrate anew node, such as node 416 in FIG. 4 to the database system. Thebroadcast protocol 1836 may also be relied upon for one server (node) ortask daemon to communicate to other nodes or components of nodes toread, write, or update data locally stored on disk at various locationsin the database system.

The memory 1822 may additionally include several applications forservers 1800 to participate in a distributed database community, such asswarm systems 100, 300, 500. Applications 1838 stored in memory 1822include various task daemons 1840 to complete system tasks both locallyand globally, cooperating with task daemons 1840 at other servers.Combinators 1842 and swarm algorithms 1850 described in precedingsections may be stored in the applications 1838. Also included areread/write operations 1844, 1846, which determine protocols for taskdaemons 1840 to fetch data and write data to rows, including operationssuch as get( ) set( ) and nextrow( ) requests. Applications 1838 mayadditionally include search functions 1852 and merge functions 1854 forstoring, merging, searching and updating operations to manage datastored at the server system 1800.

Memory 1822 also includes data storage 1858 to store data accessed andmanaged by applications 1838 or applications at other servers andmachines. Stored data includes data tables 1860 and transaction logs1862 for storing and recording data being retrieved or accessed. Datastorage 1858 includes maps 1864 for storing hash key and row locations(bucket partitions) of data stored on data tables 1860. Data storage1858 also includes data for searching and logging data retrieved bysearch engines, such as crawl/tag indices 1870, operators library 1872,tag library 1874, and so on.

Memory 1822 also includes an additional cache 1878 for additionalstorage and applications/data related to maintaining a visualizationtool 1880.

FIG. 18 is intended more as a functional description of the variousfeatures which may be present in a distributed database system ratherthan as a structural schematic of the embodiments described herein. Inpractice, and as recognized by those of ordinary skill in the art, thefunctions of the server 1800 may be distributed over a large number ofservers or computers, with various groups of the servers performingparticular subsets of those functions. Items shown separately in FIG. 18could be combined and some items could be separated. For example, someitems shown separately in FIG. 18 could be implemented on single serversand single items could be implemented by one or more servers. The actualnumber of servers in a distributed database system and how features areallocated among them will vary from one implementation to another, andmay depend in part on the amount of information stored by the systemand/or the amount data traffic that the system must handle.

FIG. 19 represents a number of daemon applications 1904 that may beincluded, but is not limited to, in the server system 1800 of FIG. 18.Some daemon applications, such as replication 1912, repair 1914, trash1924, mapjob 1932, bucket 1936, reader 1938 and writer 1940, aredescribed in detail in other sections. The daemon application listadditionally includes, but is not limited to the following:

Webserver 1916—a frames-based implementation of an http server.

Crawler 1920, Image Crawler 1922, Live Crawler 1923—frames-based serversthat crawl webpages, images, and frequently-updated webpages,respectively.

Global Server 1926—used to store data which is replicated to every nodeof the cluster. This data can be read quickly because accessing it doesnot have to occur across the network.

Logger Server 1928—used to collect statistics about the database systemand record them in the database.

Fileserver 1930—used to send files across the network, such as when therepair daemon copies a bucket to create a new bucket replica.

RAM daemon 1934—holds a subset of the database tables in memory forquick access.

Heartbeat daemon 1942—used to hold the mapping of buckets to nodes, andto exchange this map info with other nodes.

Monitoring system 1944—used to monitor the performance and availabilityof the database system.

Out-of-Memory (OOM) daemon 1946—monitors the memory usage of processes,and make decisions as to which processes should be disabled if thedatabase system is low on memory. These decisions are made with theknowledge of how the distributed database system is organized, unlike adecision made by the Linux OOM system.

Check-r 1948—monitors the R-level (replication level) of the databasesystem, and also announces the appearance and disappearance of nodes anddisks in the system.

H. Client System

FIG. 20 illustrates a block diagram of an embodiment of a client system2000, such as those used by the clients 110 (FIG. 1). The client system2000 may include at least one data processor or central processing unit(CPU) 2010, one or more optional user interfaces 2014, a communicationsor network interface 2020 for communicating with other computers,servers and/or clients, a memory 2022 and one or more signal lines 2012for coupling these components to one another. The user interface 2014may have a keyboard/mouse 2016 and/or a display 2018. The one or moresignal lines 2012 may constitute one or more communications busses.

The memory 2022 may include high-speed random access memory and/ornon-volatile memory, such as one or more magnetic disk storage devices.The memory 2022 may store an operating system 2032, such as LINUX, UNIXor WINDOWS, that includes procedures for handling basic system servicesand for performing hardware dependent tasks. The memory 2022 may alsostore communication procedures in a network communication module 2034.The communication procedures are used for communicating with server(s)1800 (FIG. 18).

The memory may also include the following elements, or a subset orsuperset of such elements: a browser or browser tool module 2036, thesearch assistant module 2038 and one or more user or content siteprofiles 2070. The profiles 2070 may be generated, much like a cookie,by the search assistant module 2038 by monitoring user activities or itmay be generated remotely based on content of one or more URLs visitedor associated with a user or content site. The search assistant module2038 may include the following elements, or a subset or superset of suchelements: a transmission/monitoring module 2042 for monitoring userinput or for sending a search query, a search results receipt module(not shown) for receiving search results and a display module 2044 fordisplaying search results. The search module 2038 may additionallyinclude instructions for operators (“/”) 2040 and filters display 2046for displaying selectable content/site tags 2048, displayed in either alisting or tabs. In embodiments where the client system 2000 is coupledto a local server computer, one or more of the modules and/orapplications in the memory 2022 may be stored in a server computer at adifferent location than the user. Memory 2022 may additionally include acache 2072 for additional storage.

Each of the above identified modules and applications correspond to aset of instructions for performing one or more functions describedabove. These modules (i.e., sets of instructions) need not beimplemented as separate software programs, procedures or modules, andthus various subsets of these modules may be combined or otherwisere-arranged in various embodiments. In some embodiments, memory 2022 or1822 may store a subset of the modules and data structures identifiedabove. For example, memory 2022 may store in a client data storage 2056,operators 2058, transaction logs 2060, crawl/tag index information 2062accessed by the user, and tag library 2064. In other embodiments, alldata stored in data storage 2056 may be stored in memory 1822 at theserver 1800. Furthermore, memory 2022 or 1822 may store additionalmodules and data structures not described above.

I. Search Overview

One application of the swarm database system 350 is a search engine foranswering queries made by users. Results are displayed with the resultURL, content tags, site tags, and optionally a text snippet. Users mayoptionally specify operators, which are used to specialize the resultbeyond what is available using just keywords. The operators are wrappedin a specific syntax. Another interface to search results is oneproviding data of use in the Search Engine Optimization industry.

Combinators

The general-purpose combinators described with respect to FIG. 14A havea large number of applications in search and other fields. Not only arecombinators 1408 versatile in reducing the number of transactions duringoperations such as write, but combinators 1408 may also be used tosummarize data, particularly in the area of search. As will be describedfurther below, combinators 1408 allow for data to be collected moreefficiently and the summary information generated in real-time, whilereducing the amount of I/O needed to generate the summaries.

TopN and Ranking

TopN 1424 is another combinator 1408 that may be used for ranking dataitems. Given a series of data items and ranks, TopN 1424 keeps the top Ndata items and ranks. In some embodiments, TopN 1424 may be used foritems examined in a Mapjob (this is common), or additionally, TopN 1424may be used incrementally for items examined in a long-lived client,such as the crawler. The significance of “incremental” or “streaming”TopN 1424 is that it can be computed without having to run a MapReducejob and waiting a long time for the answer. TopN 1424 can also becomputed on the fly, for example in the crawler while crawling the web.

The TopN 1424 operator can be used to keep a list of webpages that arethe best answer for a given word. In this case the data item would be awebpage URL, and the rank would be importance of the word in thewebpage. By keeping a separate TopN 1424 list for every word in thedictionary, we have a crude search engine index.

Logfile

Another example of combinators 1408 used in search and other fields islogfile analysis. Most big websites generate one line of text in alogfile for every web “hit”, recording the time, which page was fetched,the IP address the request came from, and the success or failure of thetransfer. These logfiles amount to gigabytes per webserver machine perday, and each day the website owner wants to know how many hitshappened, how many failures were seen, and, e.g., what countries therequests came from. These summary items are usually generated by copyingthe logfiles from every webserver to a central machine, and running adaily batch job over all the data. Such a batch job can take most of aday to run, so the answer is not available until two days after the datais taken.

With combinators 1408 this data may be collected more efficiently andthe summary information generated in real-time, while reducing theamount of I/O needed to generate the summaries. First off, the logfiledata can be added to a table in the database using the append combinator1428, which appends lines of text to an existing set of lines of text.Next, the webservers appending this data can also immediately usecombinators 1408 to compute the summary information. For example,comb_add 1430 can be used to count the requests from every country,comb_add 1430 can be used to count the total hits, and so on. Sincecombinators combine their data, generating this information does notresult in billions of transactions, but only millions.

Since all of this summarization is being done in real time, the summaryanswers are available with only a short time-lag of perhaps fiveminutes, not two days, after the logfile entries are appended.

Applying Combinators to Email Spam

Another use of combinators 1408 includes detecting email spam inreal-time. One method of detecting spam is to compute a set of“signatures” based on the email headers and content, and checking to seeif the same signatures are present in a large number of emails to alarge number of people. The Logcount( ) combinator 1422 can be used tocount how many recipients have received a given signature. When thiscount grows too large, the signature might be suspected to be spam. Inaddition, each signature can have a logcount of how many IP addresseshave sent it. This can help determine if the spam is being sent throughopen relays (a high rate of sending through few IP addresses) or via abotnet (a lower rate of sending over a large number of IP addresses).

Query Serving

In search engines generally, the highest ranked pages for a given termare kept in a small head list, and a much longer list is called the deeplist. Most simple queries can be answered by consulting only the headlist, which is faster than consulting the deep list. A multi-term queryis answered by intersecting lists for all of the query terms. Again, ifintersecting the head lists provides enough answers, the results areprovided faster than intersecting the deep lists. Search results storedin cache are used for common queries.

In addition to storing head and deep lists for every word in thedictionary, head and deep lists can be created for common pairs of words(e.g. ‘iron chef’), and common phrases consisting of pairs of wordsjoined by ‘joiner words’ such as “the” and “or.” An example of such aphrase is “Jack the Ripper” or “William of Orange.”

These head and deep lists could be represented by TopN combinators, withthe rank being the rank of the webpage. For example the “Jack theRipper” head and deep list would rank the webpages according to the rankof the term “Jack the Ripper” on these webpages.

Additional head and deep lists may also be ranked by different criteria,for example ordered by date from most recent to least recent. Thesealternate lists are used to answer queries such as “obama /date”, wherethe operator /date specifies that the user wishes the answers to beordered by date. The date used for this ordering is the “chrondate”facet, i.e. the date when a blog posting was made or a news article waspublished.

In addition to ranking based on the relevance or quality of a webpage orthe date on a webpage, other query-depending rankings may be usedinvoked by some operators. The /local operator tries to return webpagesfor entities physically near to the query, for example “pizza /local”will return pizza restaurants close to the user's location.

Crawler Application

The crawler application monitors the system and suspends itself when thesystem seems to be behind on merging as shown by the “seek100” value, orthe time that it takes a “write” to appear in the database, or othervalues. The crawler uses a large number of heuristics to determine whichpages to crawl in the future. Since there are trillions of URLs on theweb and only a few billion can be crawled, it is important to crawl onlythe most important URLs. When a URL in a link is first seen on awebpage, a row in a table is created, keyed by this new URL, containinga bunch of logcount combinators. The number of unique referring URLs andthe number of unique geographic locations of referring URLs (determinedusing the GeoIP address of the referring domain is counted. The count isat several levels of geography, including countries, US states, and UScities), the number of unique class C IP networks (the first 24 bits ofthe 32-bit IP address) of referring domains, and unique anchortext ofincoming links. By using logcount combinators for this data, a benefitis gained of not double-counting anything as URLs are repeatedlycrawled. These counts are all done on-the-fly and can be used by thecrawler to determine which URLs to crawl next.

In addition to these logcount combinators, TopN combinators are kept ofthings such as incoming links (ranked by incoming hostrank), and a TopNof incoming anchortext ranked by hostrank of the incoming link. Acomb_TopN combinator may be used of incoming anchortext ranked bylogcount of the referring URL.

In addition to the above quality data for individual URLs, similar datais also kept for every host on the Internet.

In addition to this data for URLs and hosts, other combinators are keptfor other values. One example is an “adsense id”. Webpages displayingGoogle ads have the advertiser id visible in the webpage source. A TopNof URLs and another TopN of hosts is used for every adsense idencountered. Later, if some webpages are penalized for having boguscontent and lots of ads, then all of the pages from the same adsense idcan be penalized. In the SEO pages, users of the search engine can beshown other webpages with the same adsense id as the webpage they arelooking at.

Another example is ‘fishy-cohosts’. For each IP address, a TopN of thedomains that map to this IP address are maintained. If it is laterdetermined that some of the domains are bad, the other hosts on the sameIP address may be penalized for being in a bad neighborhood.

After the crawler crawls a webpage, it immediately runs several piecesof code (called ‘classifiers’) which determine if the page has variousproperties, which are called ‘facets’. For example, in an attempt todetermine the language(s) that a webpage uses (ex: English French, . . .) a classifier for ‘language’ is executed to store the language facet.These facets may be used later in the ranking process, and also for“facet operators,” which are operators used for particularizing a typeof search query. Additional examples of facets include html elementssuch as the contents of <h1> tags, porn/not porn/unknown porn,chrondate, has video (embedded video), has audio (embedded audio), has(blog) comments (embedded blog), has images (embedded images), has agallery of images, a personal webpage, a blog, news, a governmentwebpage, a university webpage, a shopping webpage, song lyrics orpoetry, a forum webpage, a review webpage, a webpage withpositive/negative sentiment, a webpage leaning towards Liberal politics,a webpage leaning towards Conservative politics, and so on.

An example of one of the more sophisticated facets is the chrondatefacet, used by the facet operator “/date” facet operator. Many webpageshave dates on them, including webpages which display the current dateand time. Incorrectly interpreting dates has caused stock market panicssuch as the recently incorrect announcement that United Airlines hadgone bankrupt. Thus, our date facet classifier carefully considersfactors such as the date on the page, a date embedded in the page URL(common for blogs), and a date in an RSS feed, irrespective of whetherthe page is the index page of a blog or the actual blog entry.

Another example is detection of a shopping webpage. Mere mention of aproduct is not a sufficient filter. In some case, a webpage is judged tobe a shopping webpage if it has elements additional defining elements,such as the name of a product that can be purchased, a price, a shoppingcart, and a “buy” button.

In addition to determining facets in real time as pages are crawled,facets can also be computed in a batch process such as a mapjob. This isuseful if algorithms change and facets for already-crawled webpages needto be recomputed, or for facets whose values depend on looking atmultiple webpages.

Frame Version—FSM

Frames are a different way of writing threaded code. Normally threadsare implemented on a fairly low level, with operating system functions,or at a minimum with separate stacks for each process. However, threadedcode is difficult to write, difficult to understand, and is often veryinefficient.

An alternative to threads is using a set of finite state machines (FSM).Frames may be a more efficient means to express a set of finite statemachines. As an example, consider a crawler. For a given URL, thecrawler seeks the IP address of a webhost, checks a robots.txt, grabsthe actual page, runs various classifiers against the returned data, andthen updates various tables in the database with the crawled data. In athreaded implementation, one thread is utilized for each simultaneouspage being crawled. These threads need a multi-threaded library to talkto the database, and calls would need asynchronous versions, all ofwhich require complex coding.

With a FSM, the task of crawling may be divided up into N subtasks, eachconsisting of operations that can be done without blocking, e.g., thetasks up to issuing the request for the IP address. The next subtaskwould then take the results of the IP look-up and continue on until allthe subtasks are completed. The FSM may be expressed as a single thread,and use a single-threaded library to access the database, but the codingfor such tasks and subtasks are long and complex.

Frames are an efficient way to express an FSM. In a frame version of theFSM code, a pointer is positioned at the point where a block is neededuntil a result is returned. The pointer allows the process to return tothe next subtask. The code to frames simplifies the traditional FSM.Frames are integrated with the swarm system 350, 500 so that, forexample, if a subtask accomplished N get( ) operations and the nextsubtask wants these results, the frame system will not run the nextsubtask until the results from all N get( ) operations is available.This is similar to a traditional FSM, but the Frame+Swarm system tracksthat N get( ) results are needed transparently to the programmer. Framealso allows a programmer to write regular code, and end up withmultithreaded event-driven code.

In addition to the crawler, the webserver utilizes many frames. Normallya webserver (e.g. Apache or Microsoft ISS) either spawns a lot ofthreads, or processes, or both, to answer many requests. The use offrames allows the handling of high loads, in addition to making the manyget( )s from the database easy to program. As an example where framesare useful is when the web server is receiving several streams oftraffic, some of which quick answer are desired. For example, consider awebsite that gets hits from users, from RSS readers, and from crawlers.It is desirable to answer users more quickly than RSS readers and morequickly than crawlers. In the frames system, a priority to each class ofaccess is assigned, and the frames system will pick the highest prioritywork to do at each opportunity.

Process IPC

Process IPC is done with a fairly traditional “active message” paradigm.A perl hash (equivalently, a Python dictionary) is converted to a linearseries of bytes using cram( ) and on the far end, a routine is called(specified by an element in the hash) and given the uncrammed hash as anargument. Routines like cram( )/uncram( ) are often called things like“serializer/deserializer” routines or “argument marshaling” routines.Cram computes a weak checksum, which can be checked end-to-end to guardagainst corruption. (A stronger/more expensive checksum is used for datawritten to disk.)

J. User Interface Search Overview

FIG. 21 is an example of a screen display 2100 of a search query box2110 in accordance with some embodiments. The screen display 2100illustrates an example of the display 2100 viewed by a user at a client,such as client 110 of FIG. 1. In some embodiments, the user enters keywords, shortcuts, operators, and/or other search text and symbols,collectively known as “search terms,” to conduct a search query. Oncethe user enters one or more search terms, the user selects (e.g., byclicking on) a search button 2112 to initiate a database search in, forexample, any one of the distributed database systems described inprevious sections (collectively referred to as “search database”). Insome embodiments, a name, title, company logo, or any other markings,such as “Blekko™”, may be displayed next to the query box 2110. In someembodiments, a list of commonly visited sites, subjects, categories,updates, newsflash or any other topics that may be of interest to a useror affiliated with the title 2108, may be displayed under “Check theseout:” topics 2124. In some embodiments, the key words or search termslisted as topics 2124 is highlighted or in bold print, and a shortdescription is provided next to the highlighted or bold text. In someembodiments, topics 2124 include a set of search terms to enter intoquery box 2110 to search the highlighted subjects or categories. In someembodiments, the user may select “See even more” option 2126 to view alist of operators, shortcuts and instructions for conducting effectivesearches in the search database.

FIG. 22A is an example of a screen display 2200 of a search result inaccordance with some embodiments. In some embodiments, upon enteringsearch terms into the query box 2110 and selecting the search button2112, a list of search results 2220 is displayed in the screen display2200. In some embodiments, a total number of items and the size of thesearch results 2212 is displayed. For example, in response to the searchterms “tiger woods,” twelve of 50 items is displayed in the list 2220.The size of the list 2220 is 460K. The number corresponding to eachsearch result item in the list 2220 indicates where the respectivesearch database ranked a particular site in the total list of items2220. In some embodiments, the list 2220 is displayed on a web tab 2214,which is one of seven tab options on display 2200. Fewer than seven taboptions may be utilized on display 2200, or alternatively more thanseven tab options may be used. The web tab 2214 displays the list 2220of the most relevant “web” topics from the internet and determined bythe search database. The web tab 2214 and other tabs are describedfurther in later sections. The search can be further refined or a newsearch can be entered in the query box 2110 from the display 2200. Insome embodiments, additional operators may be selected to view a list ofoperators, shortcuts and instructions to conduct additional searches.

FIG. 22B is an example of a search result item 2222 from the listedsearch result items 2220 of FIG. 22A in accordance with someembodiments. In some embodiments, the search result item 2222 ispresented differently than standard search engines. Results in the list2220, such as result item 2222, follow a two-line format. In someembodiments, the first line is dedicated to a Page URL title 2230 of theresult item 2222 and a name of the web site 2232. For example, the firstline of the first result item 2222 for the search “Tiger Woods” includesthe Page URL title 2230 “Tiger Woods” and the web site title 2232“Wikipedia, the free encyclopedia.” The Page URL title 2230 is ahyperlink to the page URL, and the site title 2232 is a hyperlink to thetop level site URL. In some embodiments, the second line of each searchresult item 2222 contains three distinct elements: content tags, sitetags and optional snippets.

FIG. 22C is another embodiment for displaying search result 2240 basedon a search query. In some embodiments, the tab features 2214 of FIG.22A are not used, and instead are replaced by a selectable filter list2242 of content tags relevant to various categories for organizing thesearch result 2240. In this instance, the search result for “tigerwoods” displays a list of content tags (described in the next section)that include hits and locations related to the topic of “tiger woods.”The filter list 2242 is a dynamically generated list of content tagsbased on the entered search query in box 2110 for organizing theresulting search into various optional categories. For some searchqueries, the filter list 2242 may be a smaller list or a larger listdepending on the number of sites and categories of sites related to thequery. Each item in the filter list 2242 displays in parentheses thenumber of sites associated with that content tag item. When a userselects a content tag in the filter list 2242, the browser displays thelist of items for that content tag. In some embodiments, the list ofitems is displayed or ranked in order of relevance for that sub-group ofitems.

Content Tags

Content tags are designed to give users an insight into the type ofcontent that a particular search result 2222 contains. The list ofcontent tags which the search results (items derived from a searchquery) may be organized include, but is not limited to, the following:

-   -   News—result site is determined by the database to be a news        source    -   Blog—result site is determined by the database to be a blog    -   RSS—result site has an RSS feed    -   Comments—result site has user generated commentary as part of        its content    -   Audio—result site either plays music or has audio capabilities    -   Video—result site either plays a video or has video capabilities    -   Shop—result site has ecommerce capability (shows price if        available too)    -   Photos—result site contains images    -   Adult—result site is determined to be pornographic    -   Local—a physical location of a result site is known    -   Hate—the result site contains hate speech

Content tags may be any subject of interest to a user, may begeneralized for all users or a category of users, or may be customizedfor a specific group of users, and may include topics from technical orpopular sources. Additional content tags from popular sources orspecialized sources include, but is not limited to, the following:

adult catholicism fitness liberal perl scrapbooking afam chemistry foodlinux pets sports altmed christianity funny lyrics photography taoismastronomy comics games math physics tickets aviation conservative govmoney poker torrent biology crafts health movies psychology travelbiotech design hinduism music religion tv buddhism dogs islam paganismscience vc cars education judaism people scientology wiccan

Content tags may be displayed as a tab item 2214, as shown in FIG. 22A,or as list of tags, such as the filter list 2242 of FIG. 22C. When theuser selects a content tag 2242, the search result list 2220 isredisplayed such that only the items 2222 related to the selectedcontent tag 2242 are displayed. The redisplayed list 2220 is displayedaccording to the respective search database rank, (e.g., by relevance).Each content tag 2242 may be listed with additional information specificto each tag. For example, the size of the list associated with therespective content tag 2242 may also be displayed, such as shown inparentheses. In some embodiments, the filter list 2242 may be organizedaccording to major content tags 2242, such as “web” and listsub-categories of content tags 2242, such as date, sport, video, and soon.

In some embodiments, returning to the search result “tiger woods” inquery box 2110 and the general list of search result items 2220, if auser selected a filter item 2242 labeled “movies”, a list of searchresult items 2220 for “tiger woods” relating to “movies” (e.g., moviesabout Tiger Woods, referencing Tiger Woods, and so on) would bedisplayed in display 2240. If the user selects a filter item “aviation”,the display 2240 would show a list of search result items 2220 for“tiger woods” relating to aviation topics, and so on. In someembodiments, the search result list 2220 in response to a selectedfilter item is a sub-group of search result items from the a generallist of items for the search query, such as “tiger woods.” In someembodiments, the search result list 2220 is a new search result based onthe user-entered query term and one or more terms associated with theselected filter item from the filter list 2242.

Site Tags

The second line of every search results, such as result item 2222,contains a second set of tags call “site tags”. Site tags, whenselected, present to the user information about the result site itself.The following includes, but is not limited, the list of site tags 2302,2404:

-   -   links—displays pages that link to the result site    -   seo—displays a host of search engine optimization data for the        result site    -   rss—displays updates or changes to content of a website    -   cache—displays cached version of the result site according to        the search database    -   source—displays the source document for the result site    -   ip—displays the ip address of the result site and other sites        hosted on that same address    -   rank—displays a list of the rank of each result for the query        according to the search database    -   hostrank—re-ranks the results for the query the rank of the        host, not the page    -   operators—organizes query results according to categories        (described in detail in later sections)

FIG. 23 is an example of a screen display 2300 showing one of thecontent tags, an rss tag 2302, for a search result 2222. For example,when a user selects the rss tag 2302 in the second line of results item2222, the rss feed page is shown in display 2300. The rss feed page mayinclude a brief summary of the rss feed 2304 and instructions forjoining the particular rss feed. Users may obtain updates on theparticular search result item 2222 or view recent changes to content2308 on the result item 2222 page. The rss feed may additionally includethe latest update by date 2306. When other content tags are availablefor the particular search result 2222, other tags are listed in the samesection as the rss tag 2302.

FIG. 24A is an example of a screen display 2400 of a selected LINKS tag2402 for the search result 2222 in accordance with some embodiments. Forthe result item 2222 from a search of “tiger woods,” four site tags aredisplayed seo, links, cache, and source. When he LINKS tag is selected,a list of pages 2408 that link to the search result item 2222 isdisplayed. In some embodiments, the link is displayed according to rankcomputations by the search database.

FIG. 24B shows an alternate embodiment for displaying a search browser2401 according to other embodiments. As previously described, thecontent tags that are displayed as tabs in FIG. 24A are now displayed asa list of tags 2442. When a user selects the “links” site tag, thebrowser 2401 displays a list of items from the search result that areassociated with “links” and the displayed result includes additionalcontent tags in list 2442. In some embodiments, additional content tagswithin the category of “link” may be selected to refine or adjust thesearch result list to items relating to the selected content tag ortags.

The “operators” site tag is used to display and edit which operatorsinclude this URL: list operators, facet operators, and so on. The listof list operators can be edited by the user to suggest adding a new ordeleting an existing operator.

FIG. 25 is an example of a screen display 2500 of a selected CACHE tag2502 for the search result 2222 in accordance with some embodiments. Thecached page for the search result 2222 includes the URL 2506 for thesearch result item 2222 and the search terms highlighted in the content2508 of the displayed cached web page. The URL 2506 also includes thedate of the cached page. The content 2508 shows data that was previouslyposted for the URL site 2506 on Dec. 2, 2008.

FIG. 26 is an example of a screen display 2600 of a selected SOURCE tag2602 for the search result 2222 in accordance with some embodiments.Thus the source code 2608 is provided for the search result item 2222.

The content tags and site tags, expands the user to addition informationthat is not typically available in other database systems. The user hasaccess, with a click of a mouse, to detailed information, that includesnot only content for search terms, but also information about respectiveweb pages and other technical information. Users determine which contentor site tags to display by configuring their preferences (located at thetop of every page, not shown).

Optional Snippets

In some embodiments, the search result browser compresses the display ofits search results into two lines by not displaying snippets of eachitem in the results list 2220. Snippets are the portion of the resultsite page 2222 that contain the query term originally entered. In someembodiments, snippets are not omitted from the search results 2220. FIG.27 is an example of a screen display 2700 showing the result site page2222 in expanded form that includes a corresponding snippet portion 2704in accordance with some embodiments. The second line of each result sitepage 2222 includes an expand link 2702 which, when selected, displays(a) the snippet 2704 for that particular result site 2222, and (b) apage URL 2706 for that particular result site 2222. In some embodiments,once the expand link 2702 is clicked, the expand 2702 is changed to read“collapse” (not shown). If a user clicks on the collapse link, thesnippet 2704 and page URL 2706 for that particular result site 2222 ishidden, and the display of the results site 2222 return to the two linedisplay. It will be appreciated, that another embodiment of the display2700 may not include a row of content tabs, but instead a list ofcontent tags, such as shown in FIGS. 22C and 24B.

In some embodiments, the user may expand or collapse a single resultsite 2222 in a list of results 2708. In other embodiments, the entireresults list 2708 may be expanded when the user selects an “Expand All”button 2710 on the top right corner of the searched display 2700. TheExpand All button 2710, when selected, displays for all the results inthe displayed result list 2708 (a) their snippets (not shown) and (b)their respective page URLs (not shown). Once clicked, the Expand Allbutton 2710 is changed to read “Collapse All” (not shown). If the userclicks on the Collapse All button, the snippet and page URLs for each ofthe sites in the results list 2708 are hidden, and all of the sites inthe results list 2708 is returned to the two-line display.

SEO Information

FIG. 28 is an example of a screen display 2800 of a selected SEO tag2802 for a search result 2222 in accordance with some embodiments. Oneof the site tags for search results 2220 includes the SEO tag 2802. Asdescribed above, when a user selects one of the site tags 2402, such asthe SEO tag 2802, information about the resulting site 2222 itself isprovided. For example, SEO information is displayed when the userselects the SEO tag 2802. SEO information includes a wealth ofinformation about the way the distributed database (e.g., search engine)sees that result site page 2222, including various technical informationabout that page. There are 4 main sections of the SEO page in display2800: an overview 2810, links 2812, domain 2814, and sections 2816.

The overview tab/page 2810 in the displayed SEO page 2800 provides anoverview for the result page in question. The overview tab 2810 is thedefault tab on the SEO page 2800, and shows various informationcollected about the results site page 222 (e.g., including, but notlimited to, title, description, language, CMS (Content ManagementSystem, for example, WordPress or Drupal), last crawl date, page length,the total inbound links, rank of the page, physical location of the IP'sof the pages inbound links, and so on.) The SEO information is supportedby a variety of graphs and tables.

Three tabs on the SEO page 2800 that relate to links 2812 includeinbound, outbound and internal link information. Each of these tabsprovide detailed information about the type and nature of links relatedto the result site page 2222. The inbound links tab displays all thepages in the crawl that link to that particular result site page 2222,including, but not limited to, anchor text (if any) associated withthose links, source IP of those links, database rank of the sites, otherpages linked to the result site page 2222, and so on.

The outbound links tab/page on the SEO page 2800 provides similarinformation about the links that are generated by that particular pageto third party URLs and/or hosts. The internal links on the SEO page2800 provide similar information about links that are generated by thatparticular result site page 2222 to URLs within the same host. For eachof these links tabs 2812, the provided information is supported by avariety of graphs and tables.

The domain tab/page 2814 on the SEO page 2800 is similar to the Overviewpage 2810, except that instead of providing information for a particularpage URL, the domain page 2814 gives that same information for theentire domain. As with the other tabs 2810, 2812, the information on thedomain page 2814 is supported by a variety of graphs and tables.

The sections tab/page 2816 on the SEO page 2800 provides informationabout how the crawler (not shown) parses information on the particularresult site page 2222. The information collected and whether or not suchinformation is used to assign a rank to that page 2222 and/or otherrelated pages is displayed the sections page 2816. The sections page2816 is color coded so that the red colored sections are sections of thepage that were exclude or ignored by the database, and the green coloredsections are sections that were considered or included. The informationon the sections page 2816 is supported by a variety of graphs andtables.

It will be appreciated, that the content organized by tabs may also beorganized by a list of content items, such as filter lists shown inprevious embodiments.

Operators—Overview

User interaction with search engines typically begins with a usergenerated query submitted to the engine via a query input box, which isthen answered by the display of a set of results. Quite often, the useris looking for something other than the results they are shown, so theuser refines his or her query so as to produce a new set of results.This back and forth continues until the correct set of results (from theuser's perspective) is achieved.

Currently the only tools provided to users to help in this process arethe keywords the user concocts. The distributed database described inprevious sections provide more comprehensive search results, one thatallows users to select from a wealth of information that includescontent-specific information and technical information about the sourceof content. The organizational structure of the swarm architectureprovides powerful search tools to allow users to find the results theyare looking for at higher speeds.

FIGS. 29A-29B and 30A-30B are examples of screen displays 2900, 3000 ofresult site page 2222 in accordance with some other embodiments. FIGS.29A-29B and 30A-30B include operators 2960, 3060, which are used toexpand the search experience beyond keyword searches. The operators2960, 3060 themselves are wrapped into a specific syntax recognized bythe database structures previously described, and any other databasesystems configured to use operators 2960, 3060. In some embodiments, auser appends any query with the “/” character and then the selectedoperator 2960, 3060. For example, if the user is interests in only newsarticles for the query “Tiger Woods” as indicated in a query box 2910,the submitted search query is “Tiger Woods/news.” The operator 2960 forlimiting the search to only news articles is “/news.” If the user wasinterested in searching for just blog results, the user would submit“Tiger Woods/blogs,” where the operator 3060 for limiting the search toonly blogs is “/blogs.” Many types and categories of operators, such asoperators 2960, 3060 have been developed, and more continue to bedeveloped. Below are several lists of currently available operators.However, it will be appreciated that more operators continue to bedeveloped, and thus, operators are not limited by the lists providedbelow.

FIGS. 29A and 30A displays search results that organize content oroperators, such as operator 2960, as operator tabs 2916, 3016. In someembodiments, the operators 2916, 3016 may include the same type ofcontent or topic as content tags and content filters, or the subjectmatter may overlap with the content tags and content filters describedin previous sections. In some embodiment, search results from queriesthat include operators 2960 are displayed and organized by content taglists 2942, 3042 (or filter lists) as previously described. The contenttag lists 2942, 3042 include the one or more topics indicated by theoperator 2960 entered as part of the search query in query box 2910. Insome embodiments, the content tag lists 2942, 3042 includespredetermined tags that are also common operators, such as operators2916, 3016. In some embodiments, the content tag list 2942, 3042includes a wider range of topics as described in previous sections.

Mainstream Operators

Mainstream operators. An initial handful of operators 2916, 3016 areselected as the most commonly used or mainstream operators. It will beappreciated that these common operators 2916, 3000 may be modified,revised or replaced with other common operators or common operatorsrelevant to a particular database, group or organization. The commonlyused operators are displayed as tabs on the top of every search engineresult page, such as displayed in 2900, 3000. These tabs include:

-   -   Relevance—presents a list of results sorted by a determination        of relevance. This is the default tab.    -   Date—presents a list of results sorted chronologically (newest        to oldest). Particular data extracted from web pages is        recorded, such as a date found on the web page. This becomes the        “chrondate facet” value for that web page. The “date” tab is        selected or the “/date” modifier is used, results will be        displayed ranked according to their chrondate.    -   News Sources—presents results from an editorially selected set        of sources determined to be news sources (may be algorithmically        determined).    -   Blog—presents results from an editorially selected set of        sources determined to be blogs (may be algorithmically        determined).    -   Photos—presents results from only pages that contain photos with        the results sorted by, among other things, number and size of        photos.    -   Shop—presents results from only pages that have e-commerce        capability, sorted by relevance.    -   Local—presents results sorted by proximity to the users physical        location (as submitted by the user or, if none, the user's        physical IP location).

When any tab in the group of operators 2916, 3016 is selected, theoriginal query is appended with the relevant operator syntax—e.g., ifthe “News” tab is selected after searching for “Tiger Woods”, the queryis automatically adjusted in the query box 2910 to read “TigerWoods/news”.

Often times these content tags correspond to operators. So for instanceif a result includes the content tag “news”, clicking on the “news” tagwill commence a new search on the same query, but just for news results(and amend the original query with the /news operator).

Often times the site tags correspond to operators. So for instance if auser clicks on the site tag “links”, the query is changed to (a) the URLfor the result site where the links button was clicked and (b) appendedwith “/links”.

In some embodiments, the operators are predefined for thedatabase/search engine and users are not permitted to create operators.In some embodiments, the database allows for user input and users areenabled to create user-specified operators or set preferences to create,modify or delete predefined operators. In some embodiments, acombination of predefined operators and user-specified operators areutilized in the database.

Content Operators

In some embodiments, special query operators are utilized to limitsearches to a particular topic. For example, “/traffic” provides trafficconditions for a specified location, and “/joke” displays a random joke.Other topics include, but is not limited to, the operators described inTable 1. In some embodiments, these special query operators provide aresult in an answer from a different database, i.e. a /map query mightbe answered by displaying a map from Microsoft Maps, or a /define querymight be answered by looking up the word in a particular dictionarysource.

TABLE 1 /calendar Search for a day on the calendar Thanksgiving/calendar/define Look up a definition of a word Awesome/define /help Navigates tothis help page /help /joke Shows a random joke /joke /map Show a map ofa particular place San Francisco, Ca/map /quote Show the stock price fora BAC quote particular trading symbol /randquery Searches a random query/randquery /traffic Show traffic conditions for San Francisco,CA/traffic a particular place /weather Show the weather for a SanFrancisco/weather particular place

Facet Operators

In some embodiments, certain operators, facet operators, assist inparticular types of searches, such as to limit search to anchor textonly “/anchoronly”, and searches for only to blog sites may be limitedby including the operator “/blog.” Some facet operators may imply adifferent ranking algorithm from the usual. For example, a /porn searchmight rank URLs according to the size and number of images on the page.This would bias the results to be free galleries of images instead ofthe entrance pages for pay porn websites. A comprehensive list of facetoperators are shown, but is not limited to, the facet operators listedin Table 2.

TABLE 2 Operator Task Example Query /anchoronly Limit search to anchortext only Skrenta/anchor /audio Search only sites with audio capabilityPolka/audio /blogs Search only blog sites Izik/blogs /bug Files a bugreport for a specific query Bill dan /bug /cluster=[n] For a particularquery, determines the Dell computers/cluster=2 number of results thatwill show up from any one site /nocluster OR Turns off clustering ofresults for queries Engadget/nocluster /cluster=0 OR Engadget/cluster=0/comments Search only sites that have commentary Obama/comments /dateRank results by chronological order Mike Arrington/date /gov Search only.gov sites taxes/gov /h1 Search only the words contained in the Scoble/h1 primary heading (H1) of any site /hostrank Rank results to a queryby the overall Yahoo/hostrank rank of the host /local Rank results bygeographical proximity Gold earrings/local to user location /lyricsLimit search to song lyrics Penny lane/lyrics /news Search only newssites Bank of America/news /noporn Search only non-porn sites for aBritney spears/noporn OR particular query (safe search) OR /safe Britneyspears/safe /page=[n] Takes you to the page [n] of results for a Britneyspears/page=3 particular query /page_size=[n] Sets the number of resultsto be return for Britney spears a particular query /page_size=10 /photosRank results by sites number of sites with Madonna/photos photos /pornSearch only porn sites for a particular Playboy/porn query /rankDisplays rank numbers of results to iPod/rank specific queries/relevance Ranks results by relevance (default) United nations/relevance/rss Product an RSS feed for a search result Blekko/rss /scores Showsthe scoring of results for a Pittsburgh Steelers/scores particular query/sort_inlinks Rank results by the number of links poodles/sort_inlinkspointing to a site /shop Search only those sites that have Beefjerky/shop ecommerce functionality /title Search only the wordscontained in the calacanis/title title description of any site /topLimit searches to only top level domain Blackberry/top pages /videoSearch only sites with videos U2/video

URL Operators

In some embodiments, searches can be limited to URL operators, as listedin Table 3. For example, “/seo” results in the SEO page of a particularURL. Other URL operators include, but are not limited to, the operatorsin Table 3.

TABLE 3 Operator Task Example Query /anchor Show anchors and anchorhttp://www.gigaom.com//anchor count for a given URL /cache View cachedversion http://www.gawker.com//cache of URL /link Search for URLs thathttp://www.skrenta.com/about. link to a particular html/link URL /seoNavigates to the SEO http://battellemedia.com//seo page of a particularURL /sitelink Search for URLs that http://www.techcrunch. link to aparticular site com/link /whois Show link to whois datahttp://www.techmeme. for a particular URL com/whois

List Operators

In some embodiments, another category of operators include listoperators.

TABLE 4 Operator Contents Name Data Type Example Query huffpohttp://huffingtonpost.com/ distance-1 Barack Obama/ huffpo techmemehttp://techmeme.com/ distance-1 Barack Obama/ techmeme failhttp://failblog.org/ domain name http://shipmentoffail.com/ domain namehttp://screwups.com/fail path prefix

These list operators are driven by a list containing types of contentincluding, but not limited to, domain names (google.com), URL pathprefixes (espn.com/nfl, which would match both espn.com/nfl/team1 andespn.com/nfl/team2), and individual URLs. In addition, a list operatormight include other list operators, or use special query operators,facet operators, or URL operators to add to or subtract from the listoperator.

In addition to the above, an element of the list might include both theelement on the list, and all webpages which are distance-N away on thegraph of webpages. For example, distance-1 from techcrunch.org wouldcontain all pages at the website techcrunch.org plus every webpagepointed to by any page at techcrunch.org.

For example, the /huffpo list operator initiates a search of all pagesin the index which are at or linked (distance-1) from any webpage at thedomain huffingtonpost.com. To illustrate, if a user enters a searchquery “Barack Obama/huffpo”, and a webpage at huffingtonpost.com links apage at the NY Times, that page at the NY Times may be returned as partof the answer.

These user-edited operators exist in multiple types. One type is usableby anyone and editable by anyone. For example, global list operators areeditable and useable by everyone. Another type is usable by its creatorand only edited by its creator. Other types include operators which canbe used by their creator and friends, or edited by the creator andfriends. And all combinations of the above. Users editing these listoperators might create or delete entire operators, or might add ordelete from the lists of domain names, and so on, contained in anoperator.

In order for multiple users to have operators with the same name,without colliding, a “namespace” is used to name operators. The name/greg/linux is used to indicate a /linux operator which is specific tothe user Greg. This operator is different from the global /linuxoperator.

Social methods are used to aid discovery of operators for users. Forexample, if user1 has used several of user2's operators in the past, theengine is more likely to suggest yet another of user2's operators as apossibly useful operator.

In addition to using operators in a positive fashion (e.g. /linux),operators can also be used in a negative fashion (e.g. !/linux). Thisdeletes all results from the query which match the /linux operator. Inanother example, “/linux !/blogs” would return all results which matchedthe /linux operator and did not match the /blogs operator.

In addition to negating whole operators, a list operator might contain anegative entry, which deletes any matching webpage from the results. Asan example, if all NY Times opinion information was belowhttp://nytimes.com/opinion, a user might add nytimes.com and thenegation of nytimes.com/opinion to her tag /newsonly.

Negative entries in list operators can also be marked to apply only incertain contexts. Consider the list operator /linux, which contain thewebsite 1 kml.org, which hosts the high-volume Linux Kernel Mailing List(LKML). The query “/linux /date” would then be dominated by LKMLpostings, drowning out all else. In this case, a user may add a negativeentry for 1 kml.org that only applies when the results are sorted bydate, such as when the /date operator is used. Then “/linux /date” wouldcontain topical information about Linux without being drowned out byLKML postings.

As an example of the productive use of several of these featurestogether, assume that a user want to add to the /linux list operator.The user may do a search for [linux /!linux], i.e. a page that appearsin the results for a search on [linux] which is not already included inthe /linux list operator. The user may then select some URLs which theuser believes would look good as a part of /linux, click on the“slashtags” button for each, view the existing tags for each selectedURL, and finally add the /linux list operator to the list of operatorscontaining each selected URL.

As an example of list operators changing the meaning of a query,consider the facet operator /news and the list operator /golf, whichcontain multiple golfing websites. A search for [Tiger Woods /news]likely return a large number of hits for Mr. Woods' personal life, whilea search for [Tiger Woods /golf] likely returns many more hits for TigerWoods' golf career.

In some embodiments, list operators can be collaboratively edited bymultiple end-users, perhaps aided by an employee community manager. Insome embodiments, social feedback is used to aid the process ofselecting edits which are actually applied to the user-specifiedoperator, i.e. editors are enabled to see that User Foo has had 9 of itslast 10 edits rejected, or that User Foo tends to vote against theopinions of more trusted editors.

In some embodiments, a professional ‘community manager’ helps selectwhich edits are allowed, and referees debates among end-users. In someembodiments, a hierarchy of volunteer and professional community mangersperforms these functions. Discussion forums are created to discuss editsof each list operator. A history feature allows exploring the history ofparticular domain names or URL paths.

Pre-Intersect Lists

In some embodiments, pre-intersect common filters (not shown) areutilized by a respective search operation for greater speed or depth.The web index of the search database stores many lists for particularsearch terms. For example, in a list of webpages containing the word“Greg,” each list is ordered according to the relevance of the webpageto the word “Greg.” These lists are cut off at a fixed limit, so (e.g.)only the top 10,000 webpages mentioning the word “Greg” are in the list.

When an answer to a query is requested, such as “Greg /blogs” (blogpostings mentioning the word Greg), a naive way to compute this would beto look at the list of webpages for the word Greg, and see which ones wehave labeled as blog postings. If the blog postings mentioning Greg arerare compared to mentions of Greg, there may be no blog postings aboutGreg in the Greg list.

To give a better answer in this circumstance, a list for “Greg” isgenerated containing the top N webpages mentioning “Greg” and alsohaving the property of being “/blog.” Many of such lists are generated,one for each /operator to provide a better answer.

K. Database and Search Management Visualization Tool

FIGS. 31 & 32 are examples of screen displays 3100, 3200 of avisualization tool 3100, 3200 for the search database in accordance withsome embodiments. Visualization tool 3100, 3200 provide visualrepresentation of information about the database based on structure orbehavior, measures system activities, collects software metric data tocheck on system condition, analyze operations, and check for systemanomalies. Visualization tool 3100 includes a graph 3110 of a geographicarea with dots represent GeoIP of crawled pages (in Europe, US, andworld). A graphical representation 3120, 3220 of the replication levelof every bucket in the system is also represented (color indicates R,3=green, 0=black etc) with a superimposed integer indicating thereplication level of the whole system. A webserver load 3130 ismonitored and computed by using the add combinator to count the numberof hits. Status of data stored in the special RAM cache is shown inwindow 3140. Also shown in window 3140 is a list of urls that arecurrently being crawled. This is generated using a publish/subscribemechanism. Indication of the state of various measures of node health,such as swap space usage, disk space usage, dead disks, cpu usage, andso forth, may be monitored by the graphical data 3250. Graphs of globalquantities 3260, such as global disk read and write bandwidth, globalnetwork bandwidth, the worst seek depth in the system (seek50, seek90,seek100) and so forth is monitored by data 3260.

The foregoing description, for purpose of explanation, has beendescribed with reference to specific embodiments. However, theillustrative discussions above are not intended to be exhaustive or tolimit the invention to the precise forms disclosed. Many modificationsand variations are possible in view of the above teachings. Theembodiments were chosen and described in order to best explain theprinciples of the invention and its practical applications, to therebyenable others skilled in the art to best utilize the invention andvarious embodiments with various modifications as are suited to theparticular use contemplated.

The invention claimed is:
 1. A method, comprising: at a server includinga hardware processor in communication with a database, receiving asearch query, the search query including: one or more search terms, alist operator appended to the search query utilizing a predeterminedcharacter, where the list operator includes a term located within apredetermined list that is specific to a predetermined user and that isonly editable by the predetermined user, where the term is associatedwith a plurality of instances of predetermined content identified withinthe predetermined list, a namespace term prepending the list operatorthat indicates the predetermined user, a first facet operator, and asecond facet operator; identifying the plurality of instances ofpredetermined content associated with the list operator within thepredetermined list; performing a search for the one or more search termswithin the plurality of instances of predetermined content in order togenerate search results; and returning the search results, where thesearch results are ranked according to a geographical proximity to alocation of a user, in response to identifying the first facet operatorwithin the search query, and the search results are ranked according toa number of links pointing to each search result, in response toidentifying the second facet operator within the search query.
 2. Themethod of claim 1, wherein the plurality of instances of predeterminedcontent include: one or more domain names, one or more URL pathprefixes, and one or more individual URLs.
 3. The method of claim 1,wherein: one of the plurality of instances of predetermined contentincludes a domain name, and the domain name is associated with adistance value, where the distance value indicates that all web pagespointed to by all web pages within the domain name are included withinthe instance of predetermined content, where the search for the one ormore search terms is performed within all the web pages within thedomain name, as well as all the web pages pointed to by all the webpages within the domain name.
 4. The method of claim 1, wherein: thesearch query further includes a negative list operator, where thenegative list operator includes a second term located within thepredetermined list, and the second term is prepended with apredetermined character indicating a negativity of the list operator,the second term is associated with a second plurality of instances ofpredetermined content identified within the predetermined list, and thesearch results are adjusted to remove URLs within the search resultsthat are included within the second plurality of instances ofpredetermined content.
 5. The method of claim 1, wherein: thepredetermined character includes “/” character, the plurality ofinstances of predetermined content include one or more domain names, oneor more URL path prefixes, and one or more individual URLs, one of theplurality of instances of predetermined content includes a domain name,the domain name is associated with a distance value, where the distancevalue indicates that all web pages pointed to by all web pages withinthe domain name are included within the instance of predeterminedcontent, the search for the one or more search terms is performed withinall the web pages within the domain name, as well as all the web pagespointed to by all the web pages within the domain name, the search queryfurther includes a negative list operator, where the negative listoperator includes a second term located within the predetermined list,and the second term is prepended with a predetermined characterindicating a negativity of the list operator, the second term isassociated with a second plurality of instances of predetermined contentidentified within the predetermined list, and the search results areadjusted to remove URLs within the search results that are includedwithin the second plurality of instances of predetermined content.
 6. Asystem, comprising: a server including a hardware processor incommunication with a database that: receives a search query, the searchquery including: one or more search terms, a list operator appended tothe search query utilizing a predetermined character, where the listoperator includes a term located within a predetermined list that isspecific to a predetermined user and that is only editable by thepredetermined user, where the term is associated with a plurality ofinstances of predetermined content identified within the predeterminedlist; a namespace term prepending the list operator that indicates thepredetermined user, a first facet operator, and a second facet operator;identifies the plurality of instances of predetermined contentassociated with the list operator within the predetermined list;performs a search for the one or more search terms within the pluralityof instances of predetermined content in order to generate searchresults; and returns the search results, where the search results areranked according to a geographical proximity to a location of a user, inresponse to identifying the first facet operator within the searchquery, and the search results are ranked according to, a number of linkspointing to each search result, in response to identifying the secondfacet operator within the search query.
 7. The system of claim 6,wherein the plurality of instances of predetermined content include: oneor more domain names, one or more URL path prefixes, and one or moreindividual URLs.
 8. The system of claim 6, wherein: one of the pluralityof instances of predetermined content includes a domain name, and thedomain name is associated with a distance value, where the distancevalue indicates that all web pages pointed to by all web pages withinthe domain name are included within the instance of predeterminedcontent, where the search for the one or more search terms is performedwithin all the web pages within the domain name, as well as all the webpages pointed to by all the web pages within the domain name.
 9. Thesystem of claim 6, wherein: the search query further includes a negativelist operator, where the negative list operator includes a second termlocated within the predetermined list, and the second term is prependedwith a predetermined character indicating a negativity of the listoperator, the second term is associated with a second plurality ofinstances of predetermined content identified within the predeterminedlist, and the search results are adjusted to remove URLs within thesearch results that are included within the second plurality ofinstances of predetermined content.
 10. The system of claim 6, wherein:the predetermined character includes a “/” character, the plurality ofinstances of predetermined content include one or more domain names, oneor more URL path prefixes, and one or more individual URLs, one of theplurality of instances of predetermined content includes a domain name,the domain name is associated with a distance value, where the distancevalue indicates that all web pages pointed to by all web pages withinthe domain name are included within the instance of predeterminedcontent, the search for the one or more search terms is performed withinall the web pages within the domain name, as well as all the web pagespointed to by all the web pages within the domain name, the search queryfurther includes a negative list operator, where the negative listoperator includes a second term located within the predetermined list,and the second term is prepended with a predetermined characterindicating a negativity of the list operator, the second term isassociated with a second plurality of instances of predetermined contentidentified within the predetermined list, and the search results areadjusted to remove URLs within the search results that are includedwithin the second plurality of instances of predetermined content.
 11. Asoftware program embodied on a server in communication with a database,where the software program is executed by one or more hardwareprocessors of the server to: receive at the server a search query, thesearch query including: one or more search terms, a list operatorappended to the search query utilizing a predetermined character, wherethe list operator includes a term located within a predetermined listthat is specific to a predetermined user and that is only editable bythe Predetermined user, where the term is associated with a plurality ofinstances of predetermined content identified within the predeterminedlist; a namespace term prepending the list operator that indicates thepredetermined user, a first facet operator, and a second facet operator;identify the plurality of instances of predetermined content associatedwith the list operator within the predetermined list; perform a searchfor the one or more search terms within the plurality of instances ofpredetermined content in order to generate search results; and returnthe search results, where the search results are ranked according to ageographical proximity to a location of a user, in response toidentifying the first facet operator within the search query, and thesearch results are ranked according to a number of links pointing toeach search result, in response to identifying the second facet operatorwithin the search query.